./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2526467538 <...> [ 3.119774][ T99] udevd[99]: starting version 3.2.11 [ 3.144625][ T100] udevd[100]: starting eudev-3.2.11 [ 6.707503][ T107] udevd (107) used greatest stack depth: 22608 bytes left [ 13.097512][ T30] kauditd_printk_skb: 50 callbacks suppressed [ 13.097521][ T30] audit: type=1400 audit(1688378234.641:61): avc: denied { transition } for pid=225 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.102927][ T30] audit: type=1400 audit(1688378234.641:62): avc: denied { noatsecure } for pid=225 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.106566][ T30] audit: type=1400 audit(1688378234.641:63): avc: denied { write } for pid=225 comm="sh" path="pipe:[993]" dev="pipefs" ino=993 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 13.110460][ T30] audit: type=1400 audit(1688378234.641:64): avc: denied { rlimitinh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 13.113436][ T30] audit: type=1400 audit(1688378234.641:65): avc: denied { siginh } for pid=225 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.380673][ T229] scp (229) used greatest stack depth: 22448 bytes left Warning: Permanently added '10.128.1.18' (ECDSA) to the list of known hosts. execve("./syz-executor2526467538", ["./syz-executor2526467538"], 0x7ffcc905fd40 /* 10 vars */) = 0 brk(NULL) = 0x555556c9c000 brk(0x555556c9cc40) = 0x555556c9cc40 arch_prctl(ARCH_SET_FS, 0x555556c9c300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 set_tid_address(0x555556c9c5d0) = 294 set_robust_list(0x555556c9c5e0, 24) = 0 rt_sigaction(SIGRTMIN, {sa_handler=0x7f35deb2f690, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f35deb2fd60}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f35deb2f730, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f35deb2fd60}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2526467538", 4096) = 28 brk(0x555556cbdc40) = 0x555556cbdc40 brk(0x555556cbe000) = 0x555556cbe000 mprotect(0x7f35debf1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 295 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 296 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 297 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 298 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 299 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 300 ./strace-static-x86_64: Process 296 attached [pid 296] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 296] getpid() = 296 [pid 296] mkdir("./syzkaller.5s3MMz", 0700) = 0 [pid 296] chmod("./syzkaller.5s3MMz", 0777) = 0 [pid 296] chdir("./syzkaller.5s3MMz") = 0 [pid 296] mkdir("./0", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 295 attached [pid 295] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 295] getpid() = 295 [pid 295] mkdir("./syzkaller.d28Auw", 0700) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 301 [pid 295] chmod("./syzkaller.d28Auw", 0777) = 0 [pid 295] chdir("./syzkaller.d28Auw") = 0 [pid 295] mkdir("./0", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 302 ./strace-static-x86_64: Process 301 attached [pid 301] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 301] chdir("./0") = 0 [pid 301] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 ./strace-static-x86_64: Process 302 attached [pid 301] setpgid(0, 0 [pid 302] set_robust_list(0x555556c9c5e0, 24 [pid 301] <... setpgid resumed>) = 0 [pid 301] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 302] <... set_robust_list resumed>) = 0 [pid 302] chdir("./0") = 0 [pid 302] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 302] setpgid(0, 0 [pid 301] <... openat resumed>) = 3 [pid 302] <... setpgid resumed>) = 0 [pid 302] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 302] write(3, "1000", 4) = 4 [pid 302] close(3) = 0 [pid 302] symlink("/dev/binderfs", "./binderfs") = 0 [pid 301] write(3, "1000", 4) = 4 [pid 301] close(3) = 0 [pid 301] symlink("/dev/binderfs", "./binderfs") = 0 [pid 301] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 301] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 302] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 301] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 302] <... mmap resumed>) = 0x7f35deafe000 [pid 302] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 302] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 301] <... clone resumed>, parent_tid=[303], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 303 [pid 301] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 302] <... clone resumed>, parent_tid=[304], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 304 [pid 302] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 302] <... futex resumed>) = 0 [pid 301] <... mprotect resumed>) = 0 [pid 302] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 301] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 302] <... mmap resumed>) = 0x7f35deadd000 [pid 302] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 302] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[305], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 305 [pid 302] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... clone resumed>, parent_tid=[306], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 306 [pid 301] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 304 attached [pid 304] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 304] memfd_create("syzkaller", 0) = 3 [pid 304] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 ./strace-static-x86_64: Process 306 attached [pid 306] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 306] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 306] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... futex resumed>) = 0 [pid 301] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 1 [pid 306] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 306] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... futex resumed>) = 0 [pid 301] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 1 [pid 306] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 304] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 306] <... open resumed>) = 4 [pid 306] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... futex resumed>) = 0 [pid 301] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 1 [pid 306] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 306] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... futex resumed>) = 0 [pid 306] <... futex resumed>) = 1 [pid 306] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] <... write resumed>) = 262144 [pid 304] munmap(0x7f35d66dd000, 262144) = 0 [pid 304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 304] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 305 attached ./strace-static-x86_64: Process 303 attached ./strace-static-x86_64: Process 300 attached ./strace-static-x86_64: Process 299 attached ./strace-static-x86_64: Process 298 attached ./strace-static-x86_64: Process 297 attached [ 22.105070][ T30] audit: type=1400 audit(1688378243.641:66): avc: denied { execmem } for pid=294 comm="syz-executor252" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.125594][ T30] audit: type=1400 audit(1688378243.651:67): avc: denied { read write } for pid=296 comm="syz-executor252" name="loop1" dev="devtmpfs" ino=113 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 305] set_robust_list(0x7f35deafd9e0, 24 [pid 304] <... ioctl resumed>) = 0 [pid 303] set_robust_list(0x7f35deb1e9e0, 24 [pid 300] set_robust_list(0x555556c9c5e0, 24 [pid 299] set_robust_list(0x555556c9c5e0, 24 [pid 298] set_robust_list(0x555556c9c5e0, 24 [pid 297] set_robust_list(0x555556c9c5e0, 24 [pid 305] <... set_robust_list resumed>) = 0 [pid 303] <... set_robust_list resumed>) = 0 [pid 300] <... set_robust_list resumed>) = 0 [pid 299] <... set_robust_list resumed>) = 0 [pid 298] <... set_robust_list resumed>) = 0 [pid 297] <... set_robust_list resumed>) = 0 [pid 305] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 303] memfd_create("syzkaller", 0 [pid 300] getpid( [pid 299] getpid( [pid 298] getpid( [pid 297] getpid( [pid 305] <... open resumed>) = 5 [pid 303] <... memfd_create resumed>) = 5 [pid 300] <... getpid resumed>) = 300 [pid 299] <... getpid resumed>) = 299 [pid 298] <... getpid resumed>) = 298 [pid 297] <... getpid resumed>) = 297 [pid 305] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 300] mkdir("./syzkaller.hTfQVQ", 0700 [pid 299] mkdir("./syzkaller.RJEgPO", 0700 [pid 298] mkdir("./syzkaller.aTUVIK", 0700 [pid 297] mkdir("./syzkaller.7ngmbG", 0700 [pid 305] <... futex resumed>) = 1 [pid 303] <... mmap resumed>) = 0x7f35d66dd000 [pid 300] <... mkdir resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 305] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 303] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 300] chmod("./syzkaller.hTfQVQ", 0777 [pid 299] chmod("./syzkaller.RJEgPO", 0777 [pid 298] chmod("./syzkaller.aTUVIK", 0777 [pid 297] chmod("./syzkaller.7ngmbG", 0777 [pid 300] <... chmod resumed>) = 0 [pid 299] <... chmod resumed>) = 0 [pid 298] <... chmod resumed>) = 0 [pid 297] <... chmod resumed>) = 0 [pid 300] chdir("./syzkaller.hTfQVQ" [pid 299] chdir("./syzkaller.RJEgPO" [pid 298] chdir("./syzkaller.aTUVIK" [pid 297] chdir("./syzkaller.7ngmbG" [pid 300] <... chdir resumed>) = 0 [pid 299] <... chdir resumed>) = 0 [pid 298] <... chdir resumed>) = 0 [pid 297] <... chdir resumed>) = 0 [pid 300] mkdir("./0", 0777 [pid 299] mkdir("./0", 0777 [pid 298] mkdir("./0", 0777 [pid 297] mkdir("./0", 0777 [pid 300] <... mkdir resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 303] <... write resumed>) = 262144 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 300] <... openat resumed>) = 3 [pid 299] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 300] ioctl(3, LOOP_CLR_FD [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] ioctl(3, LOOP_CLR_FD [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] close(3 [pid 299] close(3 [pid 298] close(3 [pid 297] close(3 [pid 300] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 303] munmap(0x7f35d66dd000, 262144) = 0 [pid 303] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 310 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 312 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 311 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 309 [pid 303] <... openat resumed>) = 6 [ 22.128155][ T304] loop0: detected capacity change from 0 to 512 [ 22.150225][ T30] audit: type=1400 audit(1688378243.651:68): avc: denied { open } for pid=296 comm="syz-executor252" path="/dev/loop1" dev="devtmpfs" ino=113 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 22.172330][ T303] loop1: detected capacity change from 0 to 512 [pid 303] ioctl(6, LOOP_SET_FD, 5./strace-static-x86_64: Process 311 attached ./strace-static-x86_64: Process 310 attached ./strace-static-x86_64: Process 309 attached [pid 302] <... futex resumed>) = 0 [pid 304] close(3) = 0 [pid 304] mkdir("./file1", 0777) = 0 [pid 304] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 311] set_robust_list(0x555556c9c5e0, 24 [pid 310] set_robust_list(0x555556c9c5e0, 24 [pid 309] set_robust_list(0x555556c9c5e0, 24 [pid 302] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] <... futex resumed>) = 0 [pid 302] <... futex resumed>) = 1 [pid 311] <... set_robust_list resumed>) = 0 [pid 310] <... set_robust_list resumed>) = 0 [pid 309] <... set_robust_list resumed>) = 0 [pid 305] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 311] chdir("./0" [pid 310] chdir("./0" [pid 309] chdir("./0" [pid 305] <... mount resumed>) = 0 [pid 302] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] <... ioctl resumed>) = 0 [pid 305] <... futex resumed>) = 0 [pid 305] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 312 attached [pid 312] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 312] chdir("./0") = 0 [pid 312] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 312] setpgid(0, 0) = 0 [pid 312] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 312] write(3, "1000", 4) = 4 [pid 312] close(3) = 0 [pid 312] symlink("/dev/binderfs", "./binderfs") = 0 [pid 312] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 312] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 312] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[314], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 314 [pid 312] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 312] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 312] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[315], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 315 [pid 312] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 315 attached [pid 315] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 315] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 315] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... futex resumed>) = 0 [pid 312] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 315] <... futex resumed>) = 1 [pid 315] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 315] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... futex resumed>) = 0 [pid 312] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 315] <... futex resumed>) = 1 [pid 315] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 315] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... futex resumed>) = 0 [pid 312] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 315] <... futex resumed>) = 1 [pid 315] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 315] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... futex resumed>) = 0 [pid 315] <... futex resumed>) = 1 [pid 315] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 311] <... chdir resumed>) = 0 [pid 310] <... chdir resumed>) = 0 [pid 309] <... chdir resumed>) = 0 [pid 303] close(5 [pid 302] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) ./strace-static-x86_64: Process 314 attached [ 22.182888][ T30] audit: type=1400 audit(1688378243.651:69): avc: denied { ioctl } for pid=296 comm="syz-executor252" path="/dev/loop1" dev="devtmpfs" ino=113 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 22.215645][ T30] audit: type=1400 audit(1688378243.661:70): avc: denied { mounton } for pid=301 comm="syz-executor252" path="/root/syzkaller.5s3MMz/0/bus" dev="sda1" ino=1933 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=file permissive=1 [pid 314] set_robust_list(0x7f35deb1e9e0, 24 [pid 311] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 310] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 309] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 303] <... close resumed>) = 0 [pid 302] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] <... set_robust_list resumed>) = 0 [pid 311] <... prctl resumed>) = 0 [pid 310] <... prctl resumed>) = 0 [pid 309] <... prctl resumed>) = 0 [pid 303] mkdir("./file1", 0777 [pid 302] <... futex resumed>) = 1 [pid 314] memfd_create("syzkaller", 0 [pid 311] setpgid(0, 0 [pid 310] setpgid(0, 0 [pid 309] setpgid(0, 0 [pid 303] <... mkdir resumed>) = 0 [pid 302] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 314] <... memfd_create resumed>) = 5 [pid 311] <... setpgid resumed>) = 0 [pid 310] <... setpgid resumed>) = 0 [pid 309] <... setpgid resumed>) = 0 [pid 303] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 314] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 311] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 310] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 309] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 305] <... futex resumed>) = 0 [pid 314] <... mmap resumed>) = 0x7f35d66dd000 [pid 311] <... openat resumed>) = 3 [pid 310] <... openat resumed>) = 3 [pid 309] <... openat resumed>) = 3 [pid 305] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 314] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 311] write(3, "1000", 4 [pid 310] write(3, "1000", 4 [pid 309] write(3, "1000", 4 [pid 305] <... open resumed>) = 3 [pid 311] <... write resumed>) = 4 [pid 310] <... write resumed>) = 4 [pid 309] <... write resumed>) = 4 [pid 311] close(3 [pid 310] close(3 [pid 309] close(3 [pid 314] <... write resumed>) = 262144 [pid 311] <... close resumed>) = 0 [pid 310] <... close resumed>) = 0 [pid 309] <... close resumed>) = 0 [pid 311] symlink("/dev/binderfs", "./binderfs" [pid 310] symlink("/dev/binderfs", "./binderfs" [pid 309] symlink("/dev/binderfs", "./binderfs" [pid 311] <... symlink resumed>) = 0 [pid 310] <... symlink resumed>) = 0 [pid 309] <... symlink resumed>) = 0 [pid 311] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 309] <... futex resumed>) = 0 [pid 311] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 314] munmap(0x7f35d66dd000, 262144 [pid 311] <... mmap resumed>) = 0x7f35deafe000 [pid 310] <... mmap resumed>) = 0x7f35deafe000 [pid 309] <... mmap resumed>) = 0x7f35deafe000 [pid 314] <... munmap resumed>) = 0 [pid 311] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 310] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 309] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 314] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 311] <... mprotect resumed>) = 0 [pid 310] <... mprotect resumed>) = 0 [pid 309] <... mprotect resumed>) = 0 [pid 314] <... openat resumed>) = 6 [pid 311] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 310] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 309] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [ 22.240380][ T30] audit: type=1400 audit(1688378243.731:71): avc: denied { mounton } for pid=302 comm="syz-executor252" path="/root/syzkaller.d28Auw/0/file1" dev="sda1" ino=1943 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 22.248808][ T304] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 22.248808][ T304] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 22.248808][ T304] [ 22.284383][ T303] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 22.284383][ T303] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 22.284383][ T303] [pid 314] ioctl(6, LOOP_SET_FD, 5./strace-static-x86_64: Process 319 attached ./strace-static-x86_64: Process 318 attached ./strace-static-x86_64: Process 317 attached ) = 0 [pid 311] <... clone resumed>, parent_tid=[317], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 317 [pid 310] <... clone resumed>, parent_tid=[318], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 318 [pid 309] <... clone resumed>, parent_tid=[319], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 319 [pid 305] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 319] set_robust_list(0x7f35deb1e9e0, 24 [pid 318] set_robust_list(0x7f35deb1e9e0, 24 [pid 317] set_robust_list(0x7f35deb1e9e0, 24 [pid 311] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] <... futex resumed>) = 1 [pid 302] <... futex resumed>) = 0 [pid 311] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 309] <... futex resumed>) = 0 [pid 302] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = 0 [pid 311] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 309] <... futex resumed>) = 0 [pid 302] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 311] <... mmap resumed>) = 0x7f35deadd000 [pid 310] <... mmap resumed>) = 0x7f35deadd000 [pid 309] <... mmap resumed>) = 0x7f35deadd000 [pid 311] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 310] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 309] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 311] <... mprotect resumed>) = 0 [pid 310] <... mprotect resumed>) = 0 [pid 309] <... mprotect resumed>) = 0 [pid 311] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 310] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 309] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 311] <... clone resumed>, parent_tid=[323], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 323 [pid 310] <... clone resumed>, parent_tid=[324], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 324 [pid 309] <... clone resumed>, parent_tid=[325], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 325 [pid 311] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 309] <... futex resumed>) = 0 [pid 311] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] <... set_robust_list resumed>) = 0 [pid 318] <... set_robust_list resumed>) = 0 [pid 317] <... set_robust_list resumed>) = 0 [pid 314] close(5 [pid 305] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651./strace-static-x86_64: Process 325 attached [pid 325] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 325] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 325] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 325] <... futex resumed>) = 1 [pid 325] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 ./strace-static-x86_64: Process 324 attached [pid 324] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 324] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 325] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 325] <... futex resumed>) = 1 [pid 325] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 324] <... open resumed>) = 3 [pid 325] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 325] <... futex resumed>) = 1 [pid 325] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 324] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 325] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = 1 [pid 310] <... futex resumed>) = 0 [pid 325] <... futex resumed>) = 1 [pid 324] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 310] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] <... futex resumed>) = 0 ./strace-static-x86_64: Process 323 attached [pid 325] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 324] <... mount resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 324] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] set_robust_list(0x7f35deafd9e0, 24 [pid 310] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 324] <... futex resumed>) = 0 [pid 323] <... set_robust_list resumed>) = 0 [pid 310] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 324] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 310] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] <... open resumed>) = 3 [pid 310] <... futex resumed>) = 0 [pid 324] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 323] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 324] <... open resumed>) = 4 [pid 323] <... futex resumed>) = 1 [pid 311] <... futex resumed>) = 0 [pid 324] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 311] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = 1 [pid 323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 311] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 324] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 311] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] <... mount resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 324] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 323] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 324] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 323] <... futex resumed>) = 1 [pid 311] <... futex resumed>) = 0 [pid 324] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 311] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 324] <... futex resumed>) = 1 [pid 323] <... open resumed>) = 4 [pid 311] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 324] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 323] <... futex resumed>) = 0 [pid 311] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 311] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 311] <... futex resumed>) = 0 [pid 323] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 311] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 323] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 323] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 311] <... futex resumed>) = 0 [pid 323] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 319] memfd_create("syzkaller", 0) = 5 [pid 319] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 319] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 318] memfd_create("syzkaller", 0 [pid 317] memfd_create("syzkaller", 0 [pid 314] <... close resumed>) = 0 [pid 319] munmap(0x7f35d66dd000, 262144 [pid 318] <... memfd_create resumed>) = 5 [pid 317] <... memfd_create resumed>) = 5 [ 22.293145][ T314] loop4: detected capacity change from 0 to 512 [ 22.310163][ T304] EXT4-fs (loop0): 1 orphan inode deleted [ 22.316528][ T304] EXT4-fs (loop0): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 22.341325][ T304] ext4 filesystem being mounted at /root/syzkaller.d28Auw/0/file1 supports timestamps until 2038 (0x7fffffff) [pid 314] mkdir("./file1", 0777 [pid 319] <... munmap resumed>) = 0 [pid 318] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 317] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 314] <... mkdir resumed>) = 0 [pid 305] <... write resumed>) = 262144 [pid 304] <... mount resumed>) = 0 [pid 304] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 6 [pid 304] chdir("./file1") = 0 [pid 304] ioctl(4, LOOP_CLR_FD) = 0 [pid 304] close(4) = 0 [pid 304] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 304] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 319] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 6 [pid 319] ioctl(6, LOOP_SET_FD, 5 [pid 318] <... mmap resumed>) = 0x7f35d66dd000 [pid 317] <... mmap resumed>) = 0x7f35d66dd000 [pid 314] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 305] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 319] <... ioctl resumed>) = 0 [pid 318] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 317] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 319] close(5) = 0 [pid 319] mkdir("./file1", 0777) = 0 [ 22.341483][ T30] audit: type=1400 audit(1688378243.881:72): avc: denied { mount } for pid=302 comm="syz-executor252" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 22.360050][ T319] loop2: detected capacity change from 0 to 512 [ 22.379542][ T314] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 22.379542][ T314] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 22.379542][ T314] [ 22.382792][ T319] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [pid 319] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 302] exit_group(0) = ? [pid 304] <... futex resumed>) = ? [pid 304] +++ exited with 0 +++ [pid 318] <... write resumed>) = 262144 [pid 305] <... futex resumed>) = ? [pid 318] munmap(0x7f35d66dd000, 262144 [pid 317] <... write resumed>) = 262144 [pid 305] +++ exited with 0 +++ [pid 302] +++ exited with 0 +++ [pid 318] <... munmap resumed>) = 0 [pid 318] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 6 [pid 318] ioctl(6, LOOP_SET_FD, 5 [pid 317] munmap(0x7f35d66dd000, 262144 [pid 318] <... ioctl resumed>) = 0 [pid 318] close(5) = 0 [pid 318] mkdir("./file1", 0777) = 0 [pid 318] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 317] <... munmap resumed>) = 0 [pid 317] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 6 [ 22.382792][ T319] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 22.382792][ T319] [ 22.399508][ T303] EXT4-fs (loop1): 1 orphan inode deleted [ 22.424045][ T303] EXT4-fs (loop1): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 22.431016][ T318] loop5: detected capacity change from 0 to 512 [pid 317] ioctl(6, LOOP_SET_FD, 5 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=302, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 303] <... mount resumed>) = 0 [ 22.447328][ T303] ext4 filesystem being mounted at /root/syzkaller.5s3MMz/0/file1 supports timestamps until 2038 (0x7fffffff) [ 22.455455][ T317] loop3: detected capacity change from 0 to 512 [ 22.470967][ T318] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 22.470967][ T318] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 22.470967][ T318] [ 22.472739][ T314] EXT4-fs (loop4): 1 orphan inode deleted [pid 295] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 317] <... ioctl resumed>) = 0 [pid 303] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 314] <... mount resumed>) = 0 [pid 314] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 314] chdir("./file1") = 0 [pid 314] ioctl(6, LOOP_CLR_FD) = 0 [pid 314] close(6) = 0 [pid 314] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 314] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 312] exit_group(0 [pid 315] <... futex resumed>) = ? [pid 312] <... exit_group resumed>) = ? [pid 315] +++ exited with 0 +++ [pid 314] <... futex resumed>) = ? [pid 314] +++ exited with 0 +++ [pid 312] +++ exited with 0 +++ [pid 317] close(5) = 0 [pid 317] mkdir("./file1", 0777) = 0 [pid 317] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 303] <... openat resumed>) = 5 [pid 303] chdir("./file1") = 0 [pid 303] ioctl(6, LOOP_CLR_FD) = 0 [pid 303] close(6) = 0 [pid 303] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 303] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=312, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 299] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 301] exit_group(0 [pid 299] getdents64(3, [pid 303] <... futex resumed>) = ? [pid 301] <... exit_group resumed>) = ? [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [ 22.495075][ T314] EXT4-fs (loop4): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 22.496574][ T319] EXT4-fs (loop2): 1 orphan inode deleted [ 22.518444][ T314] ext4 filesystem being mounted at /root/syzkaller.RJEgPO/0/file1 supports timestamps until 2038 (0x7fffffff) [pid 303] +++ exited with 0 +++ [pid 299] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 306] <... futex resumed>) = ? [pid 295] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 306] +++ exited with 0 +++ [pid 301] +++ exited with 0 +++ [pid 295] <... openat resumed>) = 3 [pid 295] fstat(3, [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=301, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 295] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... restart_syscall resumed>) = 0 [pid 296] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 319] <... mount resumed>) = 0 [pid 319] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 319] chdir("./file1") = 0 [pid 319] ioctl(6, LOOP_CLR_FD) = 0 [pid 319] close(6) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 299] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [ 22.523887][ T319] EXT4-fs (loop2): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 22.550549][ T30] audit: type=1400 audit(1688378244.081:73): avc: denied { unmount } for pid=299 comm="syz-executor252" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 22.561005][ T319] ext4 filesystem being mounted at /root/syzkaller.7ngmbG/0/file1 supports timestamps until 2038 (0x7fffffff) [ 22.577444][ T317] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 22.577444][ T317] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 22.577444][ T317] [pid 296] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] lstat("./0/bus", [pid 295] lstat("./0/bus", [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] unlink("./0/bus" [pid 295] unlink("./0/bus" [pid 299] <... unlink resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 299] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] lstat("./0/binderfs", [pid 295] lstat("./0/binderfs", [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./0/binderfs" [pid 295] unlink("./0/binderfs" [pid 299] <... unlink resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 299] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] lstat("./0/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] unlink("./0/bus") = 0 [pid 319] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 319] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] exit_group(0 [pid 296] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 309] <... exit_group resumed>) = ? [pid 319] <... futex resumed>) = ? [pid 319] +++ exited with 0 +++ [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./0/binderfs") = 0 [ 22.611741][ T30] audit: type=1400 audit(1688378244.151:74): avc: denied { unmount } for pid=295 comm="syz-executor252" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 22.613196][ T318] EXT4-fs (loop5): 1 orphan inode deleted [ 22.632563][ T295] EXT4-fs error (device loop0): __ext4_get_inode_loc:4350: comm syz-executor252: Invalid inode table block 0 in block_group 0 [pid 296] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 325] <... futex resumed>) = ? [pid 325] +++ exited with 0 +++ [pid 309] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=309, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 297] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 318] <... mount resumed>) = 0 [pid 318] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 297] <... umount2 resumed>) = 0 [pid 318] <... openat resumed>) = 5 [pid 297] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 318] chdir("./file1") = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 318] ioctl(6, LOOP_CLR_FD [pid 297] lstat("./0/bus", [pid 318] <... ioctl resumed>) = 0 [pid 318] close(6) = 0 [pid 318] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 318] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] unlink("./0/bus" [pid 310] exit_group(0 [pid 297] <... unlink resumed>) = 0 [pid 318] <... futex resumed>) = ? [pid 310] <... exit_group resumed>) = ? [pid 297] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 318] +++ exited with 0 +++ [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./0/binderfs") = 0 [pid 297] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 324] <... futex resumed>) = ? [pid 324] +++ exited with 0 +++ [pid 310] +++ exited with 0 +++ [ 22.637180][ T318] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 22.672812][ T295] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5830: Corrupt filesystem [ 22.675092][ T318] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/0/file1 supports timestamps until 2038 (0x7fffffff) [ 22.688815][ T295] EXT4-fs error (device loop0): ext4_quota_off:6461: inode #3: comm syz-executor252: mark_inode_dirty error [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=310, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 300] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 300] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 300] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 300] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./0/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] unlink("./0/bus") = 0 [pid 300] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] unlink("./0/binderfs") = 0 [pid 300] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 299] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 296] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] getdents64(4, [pid 296] <... openat resumed>) = 4 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] fstat(4, [pid 299] getdents64(4, [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] getdents64(4, [pid 299] close(4 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] <... close resumed>) = 0 [pid 296] getdents64(4, [pid 299] rmdir("./0/file1" [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 296] close(4 [pid 299] getdents64(3, [pid 296] <... close resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] rmdir("./0/file1" [pid 299] close(3 [pid 296] <... rmdir resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 296] getdents64(3, [pid 299] rmdir("./0" [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 296] close(3 [pid 299] mkdir("./1", 0777 [pid 296] <... close resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 296] rmdir("./0" [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 296] <... rmdir resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] mkdir("./1", 0777 [pid 299] ioctl(3, LOOP_CLR_FD [pid 296] <... mkdir resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 299] close(3 [pid 296] <... openat resumed>) = 3 [pid 299] <... close resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] close(3 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 336 [pid 296] <... close resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 337 [pid 317] <... mount resumed>) = 0 [pid 317] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 317] chdir("./file1"./strace-static-x86_64: Process 336 attached [pid 336] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 336] chdir("./1") = 0 [pid 336] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 336] setpgid(0, 0) = 0 [pid 336] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 336] write(3, "1000", 4) = 4 [pid 336] close(3) = 0 [pid 336] symlink("/dev/binderfs", "./binderfs") = 0 [pid 336] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = 0 [pid 336] <... futex resumed>) = 0 [pid 336] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] <... umount2 resumed>) = 0 [pid 336] <... mmap resumed>) = 0x7f35deafe000 [pid 336] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 300] <... umount2 resumed>) = 0 [pid 336] <... mprotect resumed>) = 0 [pid 336] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[338], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 338 [pid 336] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 336] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./0/file1", [pid 297] lstat("./0/file1", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] lstat("./0/file1", [pid 300] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... openat resumed>) = 4 [pid 297] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] fstat(4, [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... openat resumed>) = 4 [pid 295] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] getdents64(4, [pid 297] fstat(4, [pid 295] <... openat resumed>) = 4 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(4, [pid 295] fstat(4, [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] getdents64(4, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] close(4 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] <... close resumed>) = 0 [pid 297] getdents64(4, [pid 295] getdents64(4, [pid 300] rmdir("./0/file1" [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] close(4 [pid 300] <... rmdir resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 295] getdents64(4, [pid 300] getdents64(3, [pid 297] rmdir("./0/file1" [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] close(3 [pid 297] <... rmdir resumed>) = 0 [pid 295] close(4 [pid 336] <... futex resumed>) = 0 [pid 336] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 336] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 336] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] getdents64(3, [pid 295] <... close resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 300] rmdir("./0" [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] rmdir("./0/file1" [pid 300] <... rmdir resumed>) = 0 [pid 297] close(3 [pid 295] <... rmdir resumed>) = 0 [pid 300] mkdir("./1", 0777 [pid 297] <... close resumed>) = 0 [pid 295] getdents64(3, [pid 300] <... mkdir resumed>) = 0 [pid 297] rmdir("./0" [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] <... rmdir resumed>) = 0 [pid 295] close(3 [pid 300] <... openat resumed>) = 3 [pid 297] mkdir("./1", 0777 [pid 300] ioctl(3, LOOP_CLR_FD [pid 295] <... close resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] rmdir("./0" [pid 297] <... openat resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 295] <... rmdir resumed>) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] mkdir("./1", 0777 [pid 297] close(3 [pid 295] <... mkdir resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 300] close(3 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 300] <... close resumed>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... openat resumed>) = 3 [pid 336] <... clone resumed>, parent_tid=[339], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 339 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 340 [pid 295] ioctl(3, LOOP_CLR_FD [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 341 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 336] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 342 [pid 336] <... futex resumed>) = 0 [pid 336] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 338 attached [pid 338] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 338] memfd_create("syzkaller", 0) = 3 [pid 338] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 338] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 317] <... chdir resumed>) = 0 ./strace-static-x86_64: Process 340 attached ./strace-static-x86_64: Process 341 attached [pid 317] ioctl(6, LOOP_CLR_FD./strace-static-x86_64: Process 342 attached [pid 341] set_robust_list(0x555556c9c5e0, 24 [pid 342] set_robust_list(0x555556c9c5e0, 24 [pid 317] <... ioctl resumed>) = 0 [pid 342] <... set_robust_list resumed>) = 0 [pid 340] set_robust_list(0x555556c9c5e0, 24 [pid 317] close(6 [pid 341] <... set_robust_list resumed>) = 0 [pid 340] <... set_robust_list resumed>) = 0 [pid 317] <... close resumed>) = 0 [pid 342] chdir("./1" [pid 317] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] chdir("./1" [pid 317] <... futex resumed>) = 0 [pid 340] chdir("./1" [pid 342] <... chdir resumed>) = 0 [pid 341] <... chdir resumed>) = 0 [pid 317] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 340] <... chdir resumed>) = 0 [pid 342] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 341] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 311] exit_group(0 [pid 323] <... futex resumed>) = ? [pid 311] <... exit_group resumed>) = ? [pid 323] +++ exited with 0 +++ [pid 338] <... write resumed>) = 262144 [pid 338] munmap(0x7f35d66dd000, 262144) = 0 [pid 338] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 317] <... futex resumed>) = -1 (errno 18446744073709551359) [pid 342] <... prctl resumed>) = 0 [pid 341] <... prctl resumed>) = 0 [pid 340] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 337 attached ./strace-static-x86_64: Process 339 attached [pid 317] +++ exited with 0 +++ [pid 311] +++ exited with 0 +++ [pid 340] <... prctl resumed>) = 0 [pid 342] setpgid(0, 0 [pid 340] setpgid(0, 0 [pid 341] setpgid(0, 0 [pid 342] <... setpgid resumed>) = 0 [pid 340] <... setpgid resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=311, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 337] set_robust_list(0x555556c9c5e0, 24 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 339] set_robust_list(0x7f35deafd9e0, 24 [pid 337] <... set_robust_list resumed>) = 0 [pid 298] <... restart_syscall resumed>) = 0 [pid 339] <... set_robust_list resumed>) = 0 [pid 337] chdir("./1" [pid 339] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 337] <... chdir resumed>) = 0 [pid 339] <... open resumed>) = 4 [pid 337] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 337] <... prctl resumed>) = 0 [pid 339] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 340] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] fstat(3, [pid 337] setpgid(0, 0 [pid 341] <... setpgid resumed>) = 0 [pid 341] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 342] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 340] <... openat resumed>) = 3 [pid 342] <... openat resumed>) = 3 [pid 336] <... futex resumed>) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 336] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 336] <... futex resumed>) = 0 [pid 341] <... openat resumed>) = 3 [pid 340] write(3, "1000", 4) = 4 [pid 342] write(3, "1000", 4 [pid 341] write(3, "1000", 4 [pid 342] <... write resumed>) = 4 [pid 340] close(3 [pid 341] <... write resumed>) = 4 [pid 340] <... close resumed>) = 0 [ 22.707123][ T317] EXT4-fs (loop3): 1 orphan inode deleted [ 22.712737][ T317] EXT4-fs (loop3): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 22.743152][ T317] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/0/file1 supports timestamps until 2038 (0x7fffffff) [pid 342] close(3 [pid 341] close(3) = 0 [pid 340] symlink("/dev/binderfs", "./binderfs" [pid 342] <... close resumed>) = 0 [pid 336] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 337] <... setpgid resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 339] <... futex resumed>) = 1 [pid 298] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] <... umount2 resumed>) = 0 [pid 339] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 337] <... openat resumed>) = 3 [pid 298] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 337] write(3, "1000", 4) = 4 [pid 337] close(3) = 0 [pid 337] symlink("/dev/binderfs", "./binderfs") = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 337] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 337] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 339] <... mount resumed>) = 0 [pid 337] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] lstat("./0/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 339] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] unlink("./0/bus" [pid 342] symlink("/dev/binderfs", "./binderfs" [pid 341] symlink("/dev/binderfs", "./binderfs" [pid 340] <... symlink resumed>) = 0 [pid 337] <... clone resumed>, parent_tid=[343], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 343 [pid 342] <... symlink resumed>) = 0 [pid 341] <... symlink resumed>) = 0 [pid 340] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 339] <... futex resumed>) = 1 [pid 337] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 336] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 343 attached [pid 342] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... futex resumed>) = 0 [pid 339] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 338] <... openat resumed>) = 5 [pid 337] <... futex resumed>) = 0 [pid 336] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 342] <... futex resumed>) = 0 [pid 341] <... futex resumed>) = 0 [pid 340] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 338] ioctl(5, LOOP_SET_FD, 3 [pid 337] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 336] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 342] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 341] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 340] <... mmap resumed>) = 0x7f35deafe000 [pid 339] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 337] <... futex resumed>) = 0 [pid 337] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 337] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 336] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 339] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 337] <... mprotect resumed>) = 0 [pid 298] lstat("./0/binderfs", [pid 337] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[346], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 346 [pid 337] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 337] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... mmap resumed>) = 0x7f35deafe000 [pid 341] <... mmap resumed>) = 0x7f35deafe000 [pid 340] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 298] unlink("./0/binderfs" [pid 342] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 341] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 340] <... mprotect resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 342] <... mprotect resumed>) = 0 [pid 341] <... mprotect resumed>) = 0 [pid 340] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 343] set_robust_list(0x7f35deb1e9e0, 24 [pid 342] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 341] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[348], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 348 [pid 343] <... set_robust_list resumed>) = 0 [pid 342] <... clone resumed>, parent_tid=[349], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 349 [pid 341] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... clone resumed>, parent_tid=[347], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 347 [pid 343] memfd_create("syzkaller", 0 [pid 342] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 340] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... memfd_create resumed>) = 3 [pid 342] <... futex resumed>) = 0 [pid 341] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... futex resumed>) = 0 [pid 343] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 342] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 340] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... mmap resumed>) = 0x7f35d66dd000 [pid 342] <... futex resumed>) = 0 [pid 341] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 340] <... futex resumed>) = 0 [pid 342] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 341] <... mmap resumed>) = 0x7f35deadd000 [pid 340] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 342] <... mmap resumed>) = 0x7f35deadd000 [pid 341] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 340] <... mmap resumed>) = 0x7f35deadd000 [pid 342] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 341] <... mprotect resumed>) = 0 [pid 340] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 342] <... mprotect resumed>) = 0 [pid 341] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 340] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 346 attached [pid 342] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 340] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 347 attached [pid 346] set_robust_list(0x7f35deafd9e0, 24 [pid 343] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 341] <... clone resumed>, parent_tid=[350], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 350 [pid 342] <... clone resumed>, parent_tid=[351], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 351 [pid 341] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... clone resumed>, parent_tid=[352], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 352 [pid 342] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 340] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] <... futex resumed>) = 0 [pid 341] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 340] <... futex resumed>) = 0 [pid 342] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 340] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 347] set_robust_list(0x7f35deb1e9e0, 24 [pid 346] <... set_robust_list resumed>) = 0 [pid 343] <... write resumed>) = 262144 [pid 347] <... set_robust_list resumed>) = 0 [pid 346] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 343] munmap(0x7f35d66dd000, 262144 [pid 347] memfd_create("syzkaller", 0 [pid 346] <... open resumed>) = 4 [pid 343] <... munmap resumed>) = 0 ./strace-static-x86_64: Process 349 attached ./strace-static-x86_64: Process 348 attached [pid 349] set_robust_list(0x7f35deb1e9e0, 24 [pid 348] set_robust_list(0x7f35deb1e9e0, 24 [pid 349] <... set_robust_list resumed>) = 0 [pid 348] <... set_robust_list resumed>) = 0 [pid 347] <... memfd_create resumed>) = 3 [pid 346] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] openat(AT_FDCWD, "/dev/loop1", O_RDWR./strace-static-x86_64: Process 351 attached [pid 347] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 346] <... futex resumed>) = 1 [pid 343] <... openat resumed>) = 5 [pid 337] <... futex resumed>) = 0 [pid 337] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 352 attached [pid 351] set_robust_list(0x7f35deafd9e0, 24 [pid 347] <... mmap resumed>) = 0x7f35d66dd000 [pid 346] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 343] ioctl(5, LOOP_SET_FD, 3./strace-static-x86_64: Process 350 attached [pid 352] set_robust_list(0x7f35deafd9e0, 24 [pid 351] <... set_robust_list resumed>) = 0 [pid 349] memfd_create("syzkaller", 0 [pid 348] memfd_create("syzkaller", 0 [pid 347] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 346] <... mount resumed>) = 0 [pid 339] <... open resumed>) = 6 [pid 338] <... ioctl resumed>) = 0 [pid 352] <... set_robust_list resumed>) = 0 [pid 351] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 350] set_robust_list(0x7f35deafd9e0, 24 [pid 349] <... memfd_create resumed>) = 3 [pid 348] <... memfd_create resumed>) = 3 [pid 339] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 338] close(3 [pid 352] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 351] <... open resumed>) = 4 [pid 350] <... set_robust_list resumed>) = 0 [pid 349] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 348] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 347] <... write resumed>) = 262144 [pid 346] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... ioctl resumed>) = 0 [pid 339] <... futex resumed>) = 1 [pid 336] <... futex resumed>) = 0 [pid 347] munmap(0x7f35d66dd000, 262144 [pid 346] <... futex resumed>) = 1 [pid 343] close(3 [pid 337] <... futex resumed>) = 0 [pid 349] <... mmap resumed>) = 0x7f35d66dd000 [pid 348] <... mmap resumed>) = 0x7f35d66dd000 [pid 347] <... munmap resumed>) = 0 [pid 346] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 343] <... close resumed>) = 0 [pid 339] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 337] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 336] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 346] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 343] mkdir("./file1", 0777 [pid 337] <... futex resumed>) = 0 [pid 347] <... openat resumed>) = 4 [pid 346] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 343] <... mkdir resumed>) = 0 [pid 337] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 347] ioctl(4, LOOP_SET_FD, 3 [pid 346] <... open resumed>) = 3 [pid 343] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 352] <... open resumed>) = 5 [pid 351] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 349] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 348] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 338] <... close resumed>) = 0 [pid 336] <... futex resumed>) = 0 [pid 352] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 351] <... futex resumed>) = 1 [pid 350] <... open resumed>) = 4 [pid 349] <... write resumed>) = 262144 [pid 348] <... write resumed>) = 262144 [pid 346] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] <... futex resumed>) = 0 [pid 339] <... write resumed>) = 262144 [pid 338] mkdir("./file1", 0777 [pid 336] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 352] <... futex resumed>) = 1 [pid 351] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 350] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] munmap(0x7f35d66dd000, 262144 [pid 348] munmap(0x7f35d66dd000, 262144 [pid 338] <... mkdir resumed>) = 0 [pid 352] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 350] <... futex resumed>) = 1 [pid 349] <... munmap resumed>) = 0 [pid 348] <... munmap resumed>) = 0 [ 22.797281][ T338] loop4: detected capacity change from 0 to 512 [ 22.824618][ T343] loop1: detected capacity change from 0 to 512 [ 22.833411][ T347] loop2: detected capacity change from 0 to 512 [pid 338] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 350] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 349] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 348] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 347] <... ioctl resumed>) = 0 [pid 346] <... futex resumed>) = 1 [pid 342] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 340] <... futex resumed>) = 0 [pid 339] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 347] close(3 [pid 346] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 342] <... futex resumed>) = 1 [pid 341] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 339] <... futex resumed>) = 1 [pid 337] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 347] <... close resumed>) = 0 [pid 346] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 342] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 341] <... futex resumed>) = 0 [pid 340] <... futex resumed>) = 1 [pid 339] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 337] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 347] mkdir("./file1", 0777 [pid 346] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 341] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 340] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 337] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] lstat("./0/file1", [pid 352] <... futex resumed>) = 0 [pid 351] <... futex resumed>) = 0 [pid 350] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 349] <... openat resumed>) = 5 [pid 348] <... openat resumed>) = 5 [pid 347] <... mkdir resumed>) = 0 [pid 346] <... write resumed>) = 262144 [pid 336] <... futex resumed>) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 347] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [ 22.841115][ T343] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 22.841115][ T343] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 22.841115][ T343] [ 22.869683][ T338] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 22.872777][ T347] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 22.872777][ T347] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 22.872777][ T347] [pid 346] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 352] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 351] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 350] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 349] ioctl(5, LOOP_SET_FD, 3 [pid 348] ioctl(5, LOOP_SET_FD, 3 [pid 346] <... futex resumed>) = 1 [pid 338] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 337] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 346] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./0/file1") = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./0") = 0 [pid 298] mkdir("./1", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 353 ./strace-static-x86_64: Process 353 attached [pid 353] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 353] chdir("./1") = 0 [pid 353] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 353] setpgid(0, 0) = 0 [pid 353] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 353] write(3, "1000", 4) = 4 [pid 353] close(3) = 0 [pid 353] symlink("/dev/binderfs", "./binderfs") = 0 [pid 353] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 353] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 353] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[354], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 354 [pid 353] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 353] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 353] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[355], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 355 [pid 353] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 355 attached [pid 355] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 355] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 355] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 355] <... futex resumed>) = 1 [pid 355] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 352] <... mount resumed>) = 0 [pid 351] <... mount resumed>) = 0 [pid 355] <... mount resumed>) = 0 [pid 350] <... mount resumed>) = 0 [pid 355] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 355] <... futex resumed>) = 1 [pid 355] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 355] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... futex resumed>) = 0 [pid 353] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 353] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 355] <... futex resumed>) = 1 [pid 355] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 355] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... futex resumed>) = 0 [pid 355] <... futex resumed>) = 1 [pid 355] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 354 attached [pid 354] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 354] memfd_create("syzkaller", 0) = 5 [pid 354] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 354] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 354] munmap(0x7f35d66dd000, 262144) = 0 [pid 354] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 6 [pid 354] ioctl(6, LOOP_SET_FD, 5 [pid 352] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 351] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] <... ioctl resumed>) = 0 [pid 348] <... ioctl resumed>) = 0 [pid 342] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 338] ioctl(5, LOOP_CLR_FD [pid 342] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 340] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 342] <... futex resumed>) = 0 [pid 341] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 341] <... futex resumed>) = 0 [pid 340] <... futex resumed>) = 0 [pid 341] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 340] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 352] <... futex resumed>) = 1 [pid 351] <... futex resumed>) = 1 [pid 350] <... futex resumed>) = 1 [pid 349] close(3 [pid 348] close(3 [pid 338] <... ioctl resumed>) = 0 [pid 342] <... futex resumed>) = 0 [pid 341] <... futex resumed>) = 0 [pid 340] <... futex resumed>) = 0 [pid 352] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 351] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 350] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 349] <... close resumed>) = 0 [pid 348] <... close resumed>) = 0 [pid 338] close(5 [pid 342] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=43000000} [pid 341] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=43000000} [pid 340] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=43000000} [pid 354] <... ioctl resumed>) = 0 [pid 354] close(5) = 0 [pid 354] mkdir("./file1", 0777) = 0 [ 22.876402][ T343] ================================================================================ [ 22.904406][ T349] loop0: detected capacity change from 0 to 512 [ 22.910581][ T348] loop5: detected capacity change from 0 to 512 [ 22.911315][ T354] loop3: detected capacity change from 0 to 512 [ 22.917156][ T343] UBSAN: shift-out-of-bounds in fs/ext4/super.c:2493:15 [ 22.932632][ T354] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [pid 354] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 352] <... open resumed>) = 3 [pid 351] <... open resumed>) = 3 [pid 350] <... open resumed>) = 3 [pid 349] mkdir("./file1", 0777 [pid 348] mkdir("./file1", 0777 [pid 338] <... close resumed>) = 0 [pid 352] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 340] <... futex resumed>) = 0 [pid 352] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 340] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 351] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] <... mkdir resumed>) = 0 [ 22.932632][ T354] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 22.932632][ T354] [ 22.937764][ T343] shift exponent 1919383155 is too large for 32-bit type 'int' [ 22.959964][ T343] CPU: 0 PID: 343 Comm: syz-executor252 Not tainted 5.15.118-syzkaller-01748-g241da2ad5601 #0 [ 22.960181][ T347] EXT4-fs error (device loop2): __ext4_get_inode_loc:4350: comm syz-executor252: Invalid inode table block 0 in block_group 0 [ 22.970101][ T343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 [ 22.970110][ T343] Call Trace: [ 22.970115][ T343] [ 22.970120][ T343] dump_stack_lvl+0x151/0x1b7 [ 23.003261][ T343] ? io_uring_drop_tctx_refs+0x190/0x190 [ 23.008811][ T343] ? slab_free_freelist_hook+0xbd/0x190 [ 23.014194][ T343] dump_stack+0x15/0x17 [ 23.018187][ T343] __ubsan_handle_shift_out_of_bounds+0x3bf/0x420 [ 23.024444][ T343] parse_options+0x2c9d/0x2d20 [ 23.029037][ T343] ? ext4_superblock_csum_verify+0x420/0x420 [ 23.034851][ T343] ? ext4_chksum+0x14f/0x220 [ 23.039276][ T343] ? make_kgid+0x1f2/0x6f0 [ 23.043529][ T343] ? ext4_has_metadata_csum+0x14b/0x1f0 [ 23.048910][ T343] ext4_fill_super+0x2090/0x9680 [ 23.053687][ T343] ? vsnprintf+0x1b96/0x1c70 [ 23.058112][ T343] ? rwsem_write_trylock+0x15b/0x290 [ 23.063231][ T343] ? ext4_mount+0x40/0x40 [ 23.067399][ T343] ? vscnprintf+0x80/0x80 [ 23.071563][ T343] ? set_blocksize+0x1f0/0x380 [ 23.076167][ T343] ? sb_set_blocksize+0xa8/0xf0 [ 23.080858][ T343] mount_bdev+0x282/0x3b0 [ 23.085015][ T343] ? ext4_mount+0x40/0x40 [ 23.089184][ T343] ext4_mount+0x34/0x40 [ 23.093175][ T343] legacy_get_tree+0xf1/0x190 [ 23.097687][ T343] ? ext4_errno_to_code+0x140/0x140 [ 23.102724][ T343] vfs_get_tree+0x88/0x290 [ 23.106976][ T343] do_new_mount+0x28b/0xad0 [ 23.111316][ T343] ? do_move_mount_old+0x160/0x160 [ 23.116378][ T343] ? security_capable+0x87/0xb0 [ 23.121036][ T343] ? ns_capable+0x89/0xe0 [ 23.125201][ T343] path_mount+0x671/0x1070 [ 23.129456][ T343] __se_sys_mount+0x2c4/0x3b0 [ 23.133968][ T343] ? __x64_sys_mount+0xd0/0xd0 [ 23.138570][ T343] ? __kasan_check_read+0x11/0x20 [ 23.143429][ T343] __x64_sys_mount+0xbf/0xd0 [ 23.147856][ T343] do_syscall_64+0x3d/0xb0 [ 23.152113][ T343] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 23.157837][ T343] RIP: 0033:0x7f35deb73caa [ 23.162094][ T343] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 a8 00 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 23.181531][ T343] RSP: 002b:00007f35deb1e168 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 23.189778][ T343] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f35deb73caa [ 23.197588][ T343] RDX: 0000000020000040 RSI: 0000000020000500 RDI: 00007f35deb1e180 [ 23.205403][ T343] RBP: 0000000000000005 R08: 00007f35deb1e1c0 R09: 00007f35deb1e1f0 [ 23.213226][ T343] R10: 0000000000004500 R11: 0000000000000202 R12: 00007f35deb1e6b8 [ 23.221023][ T343] R13: 00007f35deb1e180 R14: 00007f35deb1e1c0 R15: 0000000000004500 [ 23.228837][ T343] [ 23.235921][ T348] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [pid 351] <... futex resumed>) = 1 [pid 350] <... futex resumed>) = 1 [pid 348] <... mkdir resumed>) = 0 [pid 342] <... futex resumed>) = 0 [pid 341] <... futex resumed>) = 0 [pid 338] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 336] exit_group(0 [pid 351] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 350] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 349] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 348] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 342] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 338] <... futex resumed>) = ? [pid 336] <... exit_group resumed>) = ? [pid 350] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 342] <... futex resumed>) = 0 [pid 341] <... futex resumed>) = 0 [pid 340] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 339] <... futex resumed>) = ? [pid 338] +++ exited with 0 +++ [pid 339] +++ exited with 0 +++ [pid 336] +++ exited with 0 +++ [pid 351] <... write resumed>) = 262144 [pid 351] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 351] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 341] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 350] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 342] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=336, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 342] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 299] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./1/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] unlink("./1/bus") = 0 [pid 299] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./1/binderfs") = 0 [pid 299] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./1/file1", [pid 349] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 349] ioctl(5, LOOP_CLR_FD [pid 299] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 349] <... ioctl resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 349] close(5 [pid 299] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 349] <... close resumed>) = 0 [pid 299] <... openat resumed>) = 4 [pid 349] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] fstat(4, [pid 349] <... futex resumed>) = 0 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 349] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 342] exit_group(0 [pid 299] getdents64(4, [pid 351] <... futex resumed>) = ? [pid 349] <... futex resumed>) = ? [pid 342] <... exit_group resumed>) = ? [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 351] +++ exited with 0 +++ [pid 299] close(4) = 0 [pid 299] rmdir("./1/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 352] <... write resumed>) = 262144 [pid 299] close(3) = 0 [pid 299] rmdir("./1") = 0 [pid 352] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] mkdir("./2", 0777 [pid 352] <... futex resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 352] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 350] <... write resumed>) = 262144 [pid 350] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... futex resumed>) = 0 [pid 350] <... futex resumed>) = 1 [ 23.235921][ T348] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 23.235921][ T348] [ 23.261716][ T349] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [ 23.284388][ T347] EXT4-fs (loop2): get root inode failed [pid 350] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 349] +++ exited with 0 +++ [pid 342] +++ exited with 0 +++ [pid 299] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=342, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 295] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 362 [pid 295] <... openat resumed>) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 295] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./1/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] unlink("./1/bus") = 0 [pid 295] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./1/binderfs") = 0 [pid 295] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./1/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./1/file1") = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./1") = 0 [pid 295] mkdir("./2", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 363 [ 23.294102][ T348] EXT4-fs (loop5): Magic mismatch, very weird! [ 23.301551][ T354] EXT4-fs (loop3): 1 orphan inode deleted [ 23.333742][ T343] ================================================================================ ./strace-static-x86_64: Process 362 attached ./strace-static-x86_64: Process 363 attached [pid 363] set_robust_list(0x555556c9c5e0, 24 [pid 362] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 363] <... set_robust_list resumed>) = 0 [pid 362] chdir("./2" [pid 363] chdir("./2" [pid 362] <... chdir resumed>) = 0 [pid 363] <... chdir resumed>) = 0 [pid 363] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 362] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 363] <... prctl resumed>) = 0 [pid 362] <... prctl resumed>) = 0 [pid 362] setpgid(0, 0 [pid 363] setpgid(0, 0) = 0 [pid 362] <... setpgid resumed>) = 0 [pid 362] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 363] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 362] write(3, "1000", 4 [pid 363] write(3, "1000", 4) = 4 [pid 362] <... write resumed>) = 4 [pid 363] close(3 [pid 362] close(3 [pid 363] <... close resumed>) = 0 [pid 362] <... close resumed>) = 0 [pid 363] symlink("/dev/binderfs", "./binderfs" [pid 362] symlink("/dev/binderfs", "./binderfs" [pid 363] <... symlink resumed>) = 0 [pid 362] <... symlink resumed>) = 0 [pid 363] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 362] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 363] <... futex resumed>) = 0 [pid 362] <... futex resumed>) = 0 [pid 348] ioctl(5, LOOP_CLR_FD [pid 363] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 362] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 363] <... mmap resumed>) = 0x7f35deafe000 [pid 362] <... mmap resumed>) = 0x7f35deafe000 [pid 363] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 362] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 363] <... mprotect resumed>) = 0 [pid 362] <... mprotect resumed>) = 0 [pid 363] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 362] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 363] <... clone resumed>, parent_tid=[364], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 364 [pid 362] <... clone resumed>, parent_tid=[365], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 365 [pid 363] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 362] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 362] <... futex resumed>) = 0 [pid 363] <... futex resumed>) = 0 [pid 362] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 362] <... futex resumed>) = 0 [pid 363] <... mmap resumed>) = 0x7f35deadd000 [pid 362] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 363] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 362] <... mmap resumed>) = 0x7f35deadd000 [pid 363] <... mprotect resumed>) = 0 [pid 362] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 363] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 362] <... mprotect resumed>) = 0 [pid 362] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 366 attached ./strace-static-x86_64: Process 365 attached ./strace-static-x86_64: Process 364 attached [pid 363] <... clone resumed>, parent_tid=[366], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 366 [pid 354] <... mount resumed>) = 0 [pid 348] <... ioctl resumed>) = 0 [pid 366] set_robust_list(0x7f35deafd9e0, 24 [pid 365] set_robust_list(0x7f35deb1e9e0, 24 [pid 364] set_robust_list(0x7f35deb1e9e0, 24 [pid 354] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 348] close(5 [pid 366] <... set_robust_list resumed>) = 0 [pid 365] <... set_robust_list resumed>) = 0 [pid 364] <... set_robust_list resumed>) = 0 [pid 363] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 362] <... clone resumed>, parent_tid=[367], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 367 [pid 354] <... openat resumed>) = 5 [pid 348] <... close resumed>) = 0 [pid 347] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) ./strace-static-x86_64: Process 367 attached [pid 366] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 365] memfd_create("syzkaller", 0 [pid 364] memfd_create("syzkaller", 0 [pid 363] <... futex resumed>) = 0 [pid 362] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 354] chdir("./file1" [pid 348] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] ioctl(4, LOOP_CLR_FD [pid 341] exit_group(0 [pid 343] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 367] set_robust_list(0x7f35deafd9e0, 24 [pid 366] <... open resumed>) = 3 [pid 365] <... memfd_create resumed>) = 3 [pid 364] <... memfd_create resumed>) = 4 [pid 363] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... chdir resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 347] <... ioctl resumed>) = 0 [pid 366] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 365] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 364] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 354] ioctl(6, LOOP_CLR_FD [pid 348] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 347] close(4 [pid 367] <... set_robust_list resumed>) = 0 [pid 366] <... futex resumed>) = 0 [pid 365] <... mmap resumed>) = 0x7f35d66dd000 [pid 364] <... mmap resumed>) = 0x7f35d66dd000 [pid 363] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 362] <... futex resumed>) = 0 [pid 354] <... ioctl resumed>) = 0 [pid 350] <... futex resumed>) = ? [pid 347] <... close resumed>) = 0 [pid 343] ioctl(5, LOOP_CLR_FD [pid 341] <... exit_group resumed>) = ? [pid 367] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 363] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 362] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] close(6 [pid 350] +++ exited with 0 +++ [pid 348] <... futex resumed>) = ? [pid 347] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... ioctl resumed>) = 0 [pid 367] <... open resumed>) = 4 [pid 363] <... futex resumed>) = 0 [pid 354] <... close resumed>) = 0 [pid 343] close(5 [pid 340] exit_group(0 [pid 367] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 352] <... futex resumed>) = ? [ 23.345969][ T354] EXT4-fs (loop3): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 23.349624][ T347] EXT4-fs (loop2): mount failed [ 23.374799][ T354] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/1/file1 supports timestamps until 2038 (0x7fffffff) [ 23.378225][ T343] EXT4-fs (loop1): Magic mismatch, very weird! [pid 347] <... futex resumed>) = ? [pid 343] <... close resumed>) = 0 [pid 340] <... exit_group resumed>) = ? [pid 367] <... futex resumed>) = 1 [pid 365] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 362] <... futex resumed>) = 0 [pid 354] <... futex resumed>) = 0 [pid 352] +++ exited with 0 +++ [pid 347] +++ exited with 0 +++ [pid 367] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 365] <... write resumed>) = 262144 [pid 364] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 362] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 354] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 353] exit_group(0 [pid 367] <... mount resumed>) = 0 [pid 365] munmap(0x7f35d66dd000, 262144 [pid 362] <... futex resumed>) = 0 [pid 355] <... futex resumed>) = ? [pid 353] <... exit_group resumed>) = ? [pid 367] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 362] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 354] <... futex resumed>) = ? [pid 355] +++ exited with 0 +++ [pid 365] <... munmap resumed>) = 0 [pid 362] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 365] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 5 [pid 365] ioctl(5, LOOP_SET_FD, 3 [pid 367] <... futex resumed>) = 0 [pid 366] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 364] <... write resumed>) = 262144 [pid 362] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 354] +++ exited with 0 +++ [pid 353] +++ exited with 0 +++ [pid 343] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 367] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 366] <... mount resumed>) = 0 [pid 364] munmap(0x7f35d66dd000, 262144 [pid 362] <... futex resumed>) = 0 [pid 343] <... futex resumed>) = 0 [pid 337] exit_group(0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=353, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 366] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 364] <... munmap resumed>) = 0 [pid 362] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 346] <... futex resumed>) = ? [pid 337] <... exit_group resumed>) = ? [pid 366] <... futex resumed>) = 1 [pid 364] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 363] <... futex resumed>) = 0 [pid 346] +++ exited with 0 +++ [pid 366] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 364] <... openat resumed>) = 5 [pid 363] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 367] <... open resumed>) = 6 [pid 366] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 365] <... ioctl resumed>) = 0 [pid 364] ioctl(5, LOOP_SET_FD, 4 [pid 363] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 367] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 367] <... futex resumed>) = 1 [pid 362] <... futex resumed>) = 0 [pid 365] close(3 [pid 298] <... openat resumed>) = 3 [pid 362] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] fstat(3, [pid 367] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 362] <... futex resumed>) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 365] <... close resumed>) = 0 [pid 365] mkdir("./file1", 0777) = 0 [pid 365] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 362] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] +++ exited with 0 +++ [pid 341] +++ exited with 0 +++ [pid 298] getdents64(3, [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=341, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 366] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 367] <... write resumed>) = 262144 [pid 366] <... open resumed>) = 6 [pid 364] <... ioctl resumed>) = 0 [pid 298] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 367] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 367] <... futex resumed>) = 1 [pid 366] <... futex resumed>) = 1 [pid 363] <... futex resumed>) = 0 [pid 362] <... futex resumed>) = 0 [pid 298] lstat("./1/bus", [pid 367] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 366] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 366] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 363] <... futex resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] unlink("./1/bus" [pid 366] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 363] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... unlink resumed>) = 0 [pid 364] close(4) = 0 [pid 364] mkdir("./file1", 0777) = 0 [pid 340] +++ exited with 0 +++ [pid 364] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 366] <... write resumed>) = 262144 [pid 343] +++ exited with 0 +++ [pid 337] +++ exited with 0 +++ [pid 300] <... openat resumed>) = 3 [pid 298] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 366] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] fstat(3, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=340, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=337, si_uid=0, si_status=0, si_utime=0, si_stime=11} --- [pid 366] <... futex resumed>) = 1 [pid 363] <... futex resumed>) = 0 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] lstat("./1/binderfs", [pid 366] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] getdents64(3, [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] unlink("./1/binderfs" [pid 297] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... unlink resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = 0 [pid 298] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 365] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 300] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] fstat(3, [pid 296] fstat(3, [pid 365] ioctl(5, LOOP_CLR_FD) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] lstat("./1/bus", [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 365] close(5 [pid 296] getdents64(3, [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] getdents64(3, [pid 365] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] unlink("./1/bus" [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 365] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 365] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] <... unlink resumed>) = 0 [pid 297] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 300] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./1/bus", [pid 300] lstat("./1/binderfs", [pid 362] exit_group(0 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] lstat("./1/bus", [pid 367] <... futex resumed>) = ? [pid 362] <... exit_group resumed>) = ? [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./1/bus" [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 367] +++ exited with 0 +++ [pid 365] <... futex resumed>) = ? [pid 300] unlink("./1/binderfs" [pid 297] <... unlink resumed>) = 0 [pid 296] unlink("./1/bus" [pid 300] <... unlink resumed>) = 0 [pid 297] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... unlink resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./1/binderfs", [pid 296] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] unlink("./1/binderfs" [pid 296] lstat("./1/binderfs", [pid 300] lstat("./1/file1", [pid 297] <... unlink resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./1/binderfs" [pid 300] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... unlink resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... openat resumed>) = 4 [pid 297] lstat("./1/file1", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] close(4) = 0 [pid 300] rmdir("./1/file1") = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] close(3) = 0 [pid 300] rmdir("./1") = 0 [pid 300] mkdir("./2", 0777) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 300] ioctl(3, LOOP_CLR_FD [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] lstat("./1/file1", [pid 364] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 364] ioctl(5, LOOP_CLR_FD [pid 300] close(3 [pid 297] <... openat resumed>) = 4 [pid 296] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] <... close resumed>) = 0 [pid 297] fstat(4, [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... openat resumed>) = 4 [pid 364] <... ioctl resumed>) = 0 [pid 297] getdents64(4, [pid 296] fstat(4, ./strace-static-x86_64: Process 368 attached [pid 364] close(5 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 368 [pid 297] getdents64(4, [pid 296] getdents64(4, [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] close(4 [pid 296] getdents64(4, [pid 297] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] rmdir("./1/file1" [pid 296] close(4 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 368] set_robust_list(0x555556c9c5e0, 24 [pid 297] getdents64(3, [pid 296] rmdir("./1/file1" [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 364] <... close resumed>) = 0 [pid 297] close(3 [pid 296] getdents64(3, [pid 297] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] rmdir("./1" [pid 296] close(3 [pid 368] <... set_robust_list resumed>) = 0 [pid 364] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... rmdir resumed>) = 0 [pid 368] chdir("./2" [pid 364] <... futex resumed>) = 0 [pid 297] mkdir("./2", 0777 [pid 296] <... close resumed>) = 0 [pid 368] <... chdir resumed>) = 0 [pid 364] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 368] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 368] setpgid(0, 0) = 0 [pid 368] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... mkdir resumed>) = 0 [pid 296] rmdir("./1" [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 363] exit_group(0 [pid 368] <... openat resumed>) = 3 [pid 368] write(3, "1000", 4) = 4 [pid 296] <... rmdir resumed>) = 0 [pid 366] <... futex resumed>) = ? [pid 363] <... exit_group resumed>) = ? [pid 296] mkdir("./2", 0777 [pid 368] close(3) = 0 [pid 368] symlink("/dev/binderfs", "./binderfs") = 0 [pid 366] +++ exited with 0 +++ [pid 296] <... mkdir resumed>) = 0 [pid 368] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... openat resumed>) = 3 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 368] <... futex resumed>) = 0 [pid 364] <... futex resumed>) = ? [pid 297] ioctl(3, LOOP_CLR_FD [pid 368] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... openat resumed>) = 3 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 368] <... mmap resumed>) = 0x7f35deafe000 [pid 296] ioctl(3, LOOP_CLR_FD [pid 297] close(3 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... close resumed>) = 0 [pid 296] close(3 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... close resumed>) = 0 [pid 368] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 368] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 369 [pid 368] <... clone resumed>, parent_tid=[370], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 370 [pid 368] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 368] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 368] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 371 [pid 368] <... mmap resumed>) = 0x7f35deadd000 [pid 368] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 368] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[372], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 372 [pid 368] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 368] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 369 attached [pid 369] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 369] chdir("./2"./strace-static-x86_64: Process 372 attached ./strace-static-x86_64: Process 371 attached ) = 0 [pid 369] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 372] set_robust_list(0x7f35deafd9e0, 24 [pid 371] set_robust_list(0x555556c9c5e0, 24 [pid 369] setpgid(0, 0./strace-static-x86_64: Process 370 attached ) = 0 [pid 372] <... set_robust_list resumed>) = 0 [pid 371] <... set_robust_list resumed>) = 0 [pid 370] set_robust_list(0x7f35deb1e9e0, 24 [pid 369] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 372] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 369] <... openat resumed>) = 3 [pid 371] chdir("./2" [pid 369] write(3, "1000", 4) = 4 [pid 369] close(3 [pid 371] <... chdir resumed>) = 0 [pid 372] <... open resumed>) = 3 [pid 370] <... set_robust_list resumed>) = 0 [pid 369] <... close resumed>) = 0 [pid 369] symlink("/dev/binderfs", "./binderfs" [pid 372] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 370] memfd_create("syzkaller", 0 [pid 369] <... symlink resumed>) = 0 [pid 369] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 369] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 371] <... prctl resumed>) = 0 [pid 372] <... futex resumed>) = 1 [pid 370] <... memfd_create resumed>) = 4 [pid 368] <... futex resumed>) = 0 [pid 368] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 368] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 371] setpgid(0, 0 [pid 372] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 369] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 370] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 369] <... clone resumed>, parent_tid=[373], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 373 [pid 369] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 369] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 369] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[374], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 374 [pid 369] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 374 attached [pid 374] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 374] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 298] <... umount2 resumed>) = 0 [pid 298] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 371] <... setpgid resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 374] <... open resumed>) = 3 [pid 371] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] lstat("./1/file1", [pid 374] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 371] <... openat resumed>) = 3 [pid 369] <... futex resumed>) = 0 [pid 298] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 369] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 374] <... futex resumed>) = 1 [pid 374] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 371] write(3, "1000", 4 [pid 298] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 374] <... mount resumed>) = 0 [pid 374] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... futex resumed>) = 0 [pid 369] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 369] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 372] <... mount resumed>) = 0 [pid 371] <... write resumed>) = 4 [pid 298] <... openat resumed>) = 4 [pid 371] close(3 [pid 298] fstat(4, [pid 372] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] <... close resumed>) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 372] <... futex resumed>) = 1 [pid 368] <... futex resumed>) = 0 [pid 371] symlink("/dev/binderfs", "./binderfs" [pid 368] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 298] getdents64(4, [pid 368] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 368] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 371] <... symlink resumed>) = 0 [pid 372] <... open resumed>) = 5 [pid 298] getdents64(4, [pid 374] <... futex resumed>) = 1 [pid 371] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 372] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] <... futex resumed>) = 0 [pid 298] close(4 [pid 374] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 298] <... close resumed>) = 0 [pid 372] <... futex resumed>) = 1 [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 368] <... futex resumed>) = 0 [pid 298] rmdir("./1/file1" [pid 368] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 368] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 374] <... open resumed>) = 4 [pid 298] <... rmdir resumed>) = 0 [pid 371] <... mmap resumed>) = 0x7f35deafe000 [pid 372] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 371] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 298] close(3 [pid 372] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 298] <... close resumed>) = 0 [pid 371] <... mprotect resumed>) = 0 [pid 298] rmdir("./1" [pid 372] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... futex resumed>) = 0 [pid 369] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 372] <... futex resumed>) = 1 [pid 371] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 369] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 368] <... futex resumed>) = 0 [pid 298] mkdir("./2", 0777 [pid 374] <... futex resumed>) = 1 [pid 374] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 374] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... futex resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 374] <... futex resumed>) = 1 [pid 374] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 373 attached [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 372] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 373] set_robust_list(0x7f35deb1e9e0, 24 [pid 371] <... clone resumed>, parent_tid=[375], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 375 [pid 298] <... openat resumed>) = 3 [pid 371] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 371] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 371] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 371] <... futex resumed>) = 0 [pid 370] <... mmap resumed>) = 0x7f35d66dd000 [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... close resumed>) = 0 [pid 371] <... mmap resumed>) = 0x7f35deadd000 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 371] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 373] <... set_robust_list resumed>) = 0 [pid 373] memfd_create("syzkaller", 0) = 5 [pid 371] <... mprotect resumed>) = 0 [pid 373] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 371] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 373] <... mmap resumed>) = 0x7f35d66dd000 [pid 371] <... clone resumed>, parent_tid=[377], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 377 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 376 [pid 371] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 376 attached ./strace-static-x86_64: Process 377 attached [pid 370] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 365] +++ exited with 0 +++ [pid 364] +++ exited with 0 +++ [pid 363] +++ exited with 0 +++ [pid 362] +++ exited with 0 +++ [pid 370] <... write resumed>) = 262144 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=363, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=362, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 370] munmap(0x7f35d66dd000, 262144 [pid 299] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [ 23.408286][ T365] loop4: detected capacity change from 0 to 512 [ 23.415187][ T364] loop0: detected capacity change from 0 to 512 [ 23.435270][ T365] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 23.447456][ T364] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [pid 376] set_robust_list(0x555556c9c5e0, 24 [pid 377] set_robust_list(0x7f35deafd9e0, 24 [pid 370] <... munmap resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] <... set_robust_list resumed>) = 0 [pid 377] <... set_robust_list resumed>) = 0 [pid 370] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 299] <... openat resumed>) = 3 [pid 295] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] fstat(3, [pid 295] <... openat resumed>) = 3 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] fstat(3, [pid 376] chdir("./2" [pid 377] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 373] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 370] <... openat resumed>) = 6 [pid 299] getdents64(3, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] getdents64(3, [pid 376] <... chdir resumed>) = 0 [pid 377] <... open resumed>) = 3 [pid 370] ioctl(6, LOOP_SET_FD, 4 [pid 299] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 ./strace-static-x86_64: Process 375 attached [pid 376] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 377] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] <... write resumed>) = 262144 [pid 299] <... umount2 resumed>) = 0 [pid 376] <... prctl resumed>) = 0 [pid 377] <... futex resumed>) = 1 [pid 375] set_robust_list(0x7f35deb1e9e0, 24 [pid 373] munmap(0x7f35d66dd000, 262144 [pid 376] setpgid(0, 0 [pid 377] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 375] <... set_robust_list resumed>) = 0 [pid 373] <... munmap resumed>) = 0 [pid 376] <... setpgid resumed>) = 0 [pid 375] memfd_create("syzkaller", 0 [pid 373] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 376] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 375] <... memfd_create resumed>) = 4 [pid 373] <... openat resumed>) = 6 [pid 376] <... openat resumed>) = 3 [pid 375] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 373] ioctl(6, LOOP_SET_FD, 5 [pid 376] write(3, "1000", 4 [pid 375] <... mmap resumed>) = 0x7f35d66dd000 [pid 371] <... futex resumed>) = 0 [pid 299] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 376] <... write resumed>) = 4 [pid 375] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 371] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] close(3 [pid 377] <... futex resumed>) = 0 [pid 373] <... ioctl resumed>) = 0 [pid 371] <... futex resumed>) = 1 [pid 370] <... ioctl resumed>) = 0 [pid 299] lstat("./2/bus", [pid 295] <... umount2 resumed>) = 0 [pid 376] <... close resumed>) = 0 [pid 377] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 373] close(5 [pid 371] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 370] close(4 [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 373] <... close resumed>) = 0 [pid 370] <... close resumed>) = 0 [pid 299] unlink("./2/bus" [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] symlink("/dev/binderfs", "./binderfs" [pid 377] <... mount resumed>) = 0 [pid 373] mkdir("./file1", 0777 [pid 370] mkdir("./file1", 0777 [pid 299] <... unlink resumed>) = 0 [pid 295] lstat("./2/bus", [pid 376] <... symlink resumed>) = 0 [pid 377] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] <... mkdir resumed>) = 0 [pid 370] <... mkdir resumed>) = 0 [pid 299] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 373] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 371] <... futex resumed>) = 0 [pid 370] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 377] <... futex resumed>) = 1 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 376] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] unlink("./2/bus" [pid 376] <... futex resumed>) = 0 [pid 377] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 375] <... write resumed>) = 262144 [pid 376] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 375] munmap(0x7f35d66dd000, 262144 [pid 376] <... mmap resumed>) = 0x7f35deafe000 [pid 375] <... munmap resumed>) = 0 [pid 376] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 375] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 376] <... mprotect resumed>) = 0 [pid 375] <... openat resumed>) = 5 [pid 376] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 375] ioctl(5, LOOP_SET_FD, 4./strace-static-x86_64: Process 378 attached [pid 371] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] lstat("./2/binderfs", [pid 295] <... unlink resumed>) = 0 [pid 378] set_robust_list(0x7f35deb1e9e0, 24 [pid 371] <... futex resumed>) = 1 [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 378] <... set_robust_list resumed>) = 0 [pid 371] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] unlink("./2/binderfs" [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 378] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... unlink resumed>) = 0 [pid 295] lstat("./2/binderfs", [ 23.493897][ T370] loop5: detected capacity change from 0 to 512 [ 23.496753][ T373] loop2: detected capacity change from 0 to 512 [ 23.516940][ T373] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 23.516940][ T373] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 23.516940][ T373] [ 23.534485][ T375] loop1: detected capacity change from 0 to 512 [pid 299] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] unlink("./2/binderfs" [pid 299] lstat("./2/file1", [pid 295] <... unlink resumed>) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] lstat("./2/file1", [pid 299] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... openat resumed>) = 4 [pid 295] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] fstat(4, [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] getdents64(4, [pid 295] <... openat resumed>) = 4 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] fstat(4, [pid 299] getdents64(4, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] getdents64(4, [pid 299] close(4 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] <... close resumed>) = 0 [pid 295] getdents64(4, [pid 299] rmdir("./2/file1" [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 295] close(4 [pid 299] getdents64(3, [pid 295] <... close resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] rmdir("./2/file1" [pid 299] close(3 [pid 295] <... rmdir resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 295] getdents64(3, [pid 299] rmdir("./2" [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 295] close(3 [pid 299] mkdir("./3", 0777 [pid 295] <... close resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 295] rmdir("./2" [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 295] <... rmdir resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 295] mkdir("./3", 0777 [pid 299] ioctl(3, LOOP_CLR_FD [pid 295] <... mkdir resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 299] close(3 [pid 295] <... openat resumed>) = 3 [pid 299] <... close resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] close(3 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 379 [pid 295] <... close resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 380 ./strace-static-x86_64: Process 379 attached [pid 379] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 379] chdir("./3") = 0 [pid 379] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 377] <... futex resumed>) = 0 [pid 376] <... clone resumed>, parent_tid=[378], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 378 [pid 377] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 379] <... prctl resumed>) = 0 [pid 376] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 376] <... futex resumed>) = 1 [pid 378] memfd_create("syzkaller", 0 [pid 376] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... memfd_create resumed>) = 3 [pid 378] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66fe000 [pid 378] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 376] <... futex resumed>) = 0 [pid 378] <... write resumed>) = 262144 [pid 378] munmap(0x7f35d66fe000, 262144) = 0 [pid 378] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 376] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 378] <... openat resumed>) = 4 [pid 379] setpgid(0, 0 [pid 378] ioctl(4, LOOP_SET_FD, 3 [pid 376] <... mmap resumed>) = 0x7f35d671d000 [pid 379] <... setpgid resumed>) = 0 [pid 376] mprotect(0x7f35d671e000, 131072, PROT_READ|PROT_WRITE [pid 377] <... open resumed>) = 6 [pid 375] <... ioctl resumed>) = 0 [pid 379] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 376] <... mprotect resumed>) = 0 [pid 377] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] close(4./strace-static-x86_64: Process 380 attached [pid 378] <... ioctl resumed>) = 0 [pid 376] clone(child_stack=0x7f35d673d3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 377] <... futex resumed>) = 1 [pid 375] <... close resumed>) = 0 [pid 371] <... futex resumed>) = 0 ./strace-static-x86_64: Process 383 attached [pid 380] set_robust_list(0x555556c9c5e0, 24 [pid 379] <... openat resumed>) = 3 [pid 378] close(3 [pid 377] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 375] mkdir("./file1", 0777 [pid 371] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 383] set_robust_list(0x7f35d673d9e0, 24 [pid 380] <... set_robust_list resumed>) = 0 [pid 379] write(3, "1000", 4 [pid 378] <... close resumed>) = 0 [pid 376] <... clone resumed>, parent_tid=[383], tls=0x7f35d673d700, child_tidptr=0x7f35d673d9d0) = 383 [pid 377] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 375] <... mkdir resumed>) = 0 [pid 371] <... futex resumed>) = 0 [pid 383] <... set_robust_list resumed>) = 0 [pid 379] <... write resumed>) = 4 [pid 371] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 383] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 379] close(3 [pid 376] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 375] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 383] <... open resumed>) = 3 [pid 379] <... close resumed>) = 0 [pid 383] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 379] symlink("/dev/binderfs", "./binderfs" [pid 383] <... futex resumed>) = 0 [pid 379] <... symlink resumed>) = 0 [pid 383] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 379] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 379] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 379] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 379] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[384], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 384 [pid 379] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 379] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 379] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 379] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 379] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[385], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 385 [pid 379] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 379] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 380] chdir("./3") = 0 [pid 380] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 380] setpgid(0, 0) = 0 [pid 380] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 380] write(3, "1000", 4) = 4 [pid 380] close(3) = 0 [pid 380] symlink("/dev/binderfs", "./binderfs") = 0 [pid 380] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 383] <... futex resumed>) = 0 [pid 378] mkdir("./file1", 0777 [pid 376] <... futex resumed>) = 1 [pid 380] <... futex resumed>) = 0 [pid 380] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 380] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 380] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[387], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 387 [pid 380] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 380] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 380] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[388], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 388 [pid 380] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 384 attached [ 23.542488][ T370] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 23.542488][ T370] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 23.542488][ T370] [ 23.569474][ T378] loop3: detected capacity change from 0 to 512 [ 23.580463][ T373] EXT4-fs (loop2): 1 orphan inode deleted [pid 384] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 384] memfd_create("syzkaller", 0) = 3 [pid 384] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 384] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 384] munmap(0x7f35d66dd000, 262144) = 0 [pid 384] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 384] ioctl(4, LOOP_SET_FD, 3 [pid 383] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 376] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 377] <... write resumed>) = 262144 [pid 376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 377] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... futex resumed>) = 1 [pid 371] <... futex resumed>) = 0 [pid 376] <... futex resumed>) = 1 [pid 383] <... futex resumed>) = 0 [pid 376] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 377] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 383] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 378] <... mkdir resumed>) = 0 [pid 383] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 376] <... futex resumed>) = 0 [pid 383] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 376] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 383] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 376] <... futex resumed>) = 0 [pid 383] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 376] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 383] <... open resumed>) = 5 [pid 383] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 376] <... futex resumed>) = 0 [pid 383] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 376] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... ioctl resumed>) = 0 [pid 384] close(3) = 0 [pid 384] mkdir("./file1", 0777) = 0 [pid 384] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"..../strace-static-x86_64: Process 385 attached [pid 385] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 385] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 385] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 379] <... futex resumed>) = 0 [pid 379] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 379] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 385] <... futex resumed>) = 1 [pid 385] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 385] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 379] <... futex resumed>) = 0 [pid 379] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 379] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 385] <... futex resumed>) = 1 [pid 385] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 385] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 379] <... futex resumed>) = 0 [pid 379] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 23.590025][ T373] EXT4-fs (loop2): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 23.602208][ T384] loop4: detected capacity change from 0 to 512 [ 23.621066][ T375] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 23.627504][ T373] ext4 filesystem being mounted at /root/syzkaller.7ngmbG/2/file1 supports timestamps until 2038 (0x7fffffff) [pid 379] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 383] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 376] <... futex resumed>) = 0 [pid 373] <... mount resumed>) = 0 [pid 373] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 373] chdir("./file1") = 0 [pid 373] ioctl(6, LOOP_CLR_FD) = 0 [pid 373] close(6) = 0 [pid 373] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 373] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 387 attached [pid 387] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 387] memfd_create("syzkaller", 0 [pid 369] exit_group(0 [pid 373] <... futex resumed>) = ? [pid 369] <... exit_group resumed>) = ? [pid 373] +++ exited with 0 +++ [pid 387] <... memfd_create resumed>) = 3 [pid 387] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 387] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 387] munmap(0x7f35d66dd000, 262144) = 0 [pid 387] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 380] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 380] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35d66fc000 [pid 380] mprotect(0x7f35d66fd000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 380] clone(child_stack=0x7f35d671c3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[389], tls=0x7f35d671c700, child_tidptr=0x7f35d671c9d0) = 389 [pid 380] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 387] ioctl(4, LOOP_SET_FD, 3 [pid 376] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 374] <... futex resumed>) = ? [pid 387] <... ioctl resumed>) = 0 [pid 387] close(3) = 0 [pid 387] mkdir("./file1", 0777 [pid 374] +++ exited with 0 +++ [pid 369] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=369, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 387] <... mkdir resumed>) = 0 [pid 387] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 297] <... restart_syscall resumed>) = 0 [pid 297] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 389 attached ./strace-static-x86_64: Process 388 attached [pid 385] <... futex resumed>) = 1 [pid 378] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 375] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = 0 [pid 389] set_robust_list(0x7f35d671c9e0, 24 [pid 388] set_robust_list(0x7f35deafd9e0, 24 [pid 385] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 389] <... set_robust_list resumed>) = 0 [pid 388] <... set_robust_list resumed>) = 0 [pid 375] ioctl(5, LOOP_CLR_FD [pid 297] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 388] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 375] <... ioctl resumed>) = 0 [pid 388] <... open resumed>) = 3 [pid 375] close(5 [pid 388] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] <... close resumed>) = 0 [pid 388] <... futex resumed>) = 0 [pid 375] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 375] <... futex resumed>) = 0 [pid 375] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 389] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 389] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] <... futex resumed>) = 0 [pid 380] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] <... futex resumed>) = 0 [pid 380] <... futex resumed>) = 1 [pid 388] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 380] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... open resumed>) = 5 [pid 388] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 380] <... futex resumed>) = 0 [pid 388] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 380] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 389] <... futex resumed>) = 1 [pid 389] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 379] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 379] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 379] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 383] <... write resumed>) = 262144 [pid 383] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 383] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 378] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 378] ioctl(4, LOOP_CLR_FD) = 0 [pid 378] close(4) = 0 [pid 378] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 378] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 376] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 388] <... write resumed>) = 262144 [pid 388] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 380] <... futex resumed>) = 0 [ 23.630033][ T384] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 23.630033][ T384] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 23.630033][ T384] [ 23.646222][ T387] loop0: detected capacity change from 0 to 512 [ 23.668071][ T378] EXT4-fs (loop3): VFS: Can't find ext4 filesystem [ 23.674639][ T384] EXT4-fs (loop4): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [pid 388] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 376] exit_group(0 [pid 371] exit_group(0 [pid 383] <... futex resumed>) = ? [pid 378] <... futex resumed>) = ? [pid 376] <... exit_group resumed>) = ? [pid 375] <... futex resumed>) = ? [pid 371] <... exit_group resumed>) = ? [pid 297] lstat("./2/bus", [pid 385] <... write resumed>) = 262144 [pid 383] +++ exited with 0 +++ [pid 378] +++ exited with 0 +++ [pid 376] +++ exited with 0 +++ [pid 377] <... futex resumed>) = ? [pid 375] +++ exited with 0 +++ [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 385] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 384] ioctl(4, LOOP_CLR_FD [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=376, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 297] unlink("./2/bus" [pid 385] <... futex resumed>) = 0 [pid 384] <... ioctl resumed>) = 0 [pid 385] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... unlink resumed>) = 0 [pid 384] close(4 [pid 297] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 384] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 384] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./2/binderfs", [pid 384] <... futex resumed>) = 0 [ 23.689847][ T370] EXT4-fs (loop5): 1 orphan inode deleted [ 23.691747][ T387] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 23.691747][ T387] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 23.691747][ T387] [ 23.695543][ T370] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 23.737403][ T384] EXT4-fs (loop4): group descriptors corrupted! [pid 384] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 370] <... mount resumed>) = 0 [pid 298] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 370] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 370] chdir("./file1") = 0 [pid 370] ioctl(6, LOOP_CLR_FD) = 0 [pid 370] close(6) = 0 [pid 370] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 370] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 379] exit_group(0 [pid 384] <... futex resumed>) = ? [pid 379] <... exit_group resumed>) = ? [pid 384] +++ exited with 0 +++ [pid 368] exit_group(0 [pid 372] <... futex resumed>) = ? [pid 368] <... exit_group resumed>) = ? [pid 372] +++ exited with 0 +++ [pid 370] <... futex resumed>) = ? [pid 370] +++ exited with 0 +++ [pid 368] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=368, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 300] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 300] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... openat resumed>) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] unlink("./2/binderfs") = 0 [pid 297] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 300] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./2/bus", [pid 298] lstat("./2/bus", [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] unlink("./2/bus" [pid 298] unlink("./2/bus" [pid 300] <... unlink resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 300] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 377] +++ exited with 0 +++ [pid 371] +++ exited with 0 +++ [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./2/binderfs", [pid 298] lstat("./2/binderfs", [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] unlink("./2/binderfs" [pid 298] unlink("./2/binderfs" [pid 300] <... unlink resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 300] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./2/file1") = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./2") = 0 [pid 298] mkdir("./3", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 391 [pid 387] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 387] ioctl(4, LOOP_CLR_FD) = 0 [pid 387] close(4) = 0 [pid 387] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] exit_group(0 [pid 389] <... futex resumed>) = ? [pid 388] <... futex resumed>) = ? [pid 380] <... exit_group resumed>) = ? [pid 389] +++ exited with 0 +++ [pid 388] +++ exited with 0 +++ [pid 385] <... futex resumed>) = ? [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=371, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 296] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 296] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 391 attached [pid 296] lstat("./2/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] unlink("./2/bus") = 0 [pid 391] set_robust_list(0x555556c9c5e0, 24 [pid 296] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 391] <... set_robust_list resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 391] chdir("./3" [pid 296] unlink("./2/binderfs") = 0 [pid 391] <... chdir resumed>) = 0 [pid 296] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 391] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 391] <... prctl resumed>) = 0 [pid 296] lstat("./2/file1", [pid 391] setpgid(0, 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 391] <... setpgid resumed>) = 0 [pid 296] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 391] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 391] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 4 [pid 391] write(3, "1000", 4) = 4 [pid 391] close(3) = 0 [pid 391] symlink("/dev/binderfs", "./binderfs" [pid 296] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 391] <... symlink resumed>) = 0 [pid 391] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] getdents64(4, [pid 391] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 391] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] getdents64(4, [pid 391] <... mmap resumed>) = 0x7f35deafe000 [pid 391] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] close(4 [pid 391] <... mprotect resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./2/file1" [pid 391] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] <... rmdir resumed>) = 0 [pid 296] getdents64(3, [pid 391] <... clone resumed>, parent_tid=[392], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 392 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 391] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] close(3 [pid 391] <... futex resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 391] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] rmdir("./2" [pid 391] <... futex resumed>) = 0 [pid 391] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 391] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./3", 0777 [pid 391] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[393], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 393 [pid 391] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 391] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 392 attached [pid 392] set_robust_list(0x7f35deb1e9e0, 24 [pid 296] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 392] <... set_robust_list resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 392] memfd_create("syzkaller", 0) = 3 [pid 392] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 394 ./strace-static-x86_64: Process 394 attached ./strace-static-x86_64: Process 393 attached [pid 394] set_robust_list(0x555556c9c5e0, 24 [pid 393] set_robust_list(0x7f35deafd9e0, 24 [pid 394] <... set_robust_list resumed>) = 0 [pid 393] <... set_robust_list resumed>) = 0 [pid 394] chdir("./3" [pid 393] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 394] <... chdir resumed>) = 0 [pid 394] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 394] setpgid(0, 0) = 0 [pid 394] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 394] write(3, "1000", 4 [pid 392] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 394] <... write resumed>) = 4 [pid 393] <... open resumed>) = 4 [pid 394] close(3 [pid 393] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 394] <... close resumed>) = 0 [pid 393] <... futex resumed>) = 1 [pid 391] <... futex resumed>) = 0 [pid 391] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 391] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 394] symlink("/dev/binderfs", "./binderfs" [pid 393] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 392] <... write resumed>) = 262144 [pid 392] munmap(0x7f35d66dd000, 262144) = 0 [pid 394] <... symlink resumed>) = 0 [pid 392] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 5 [pid 394] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 392] ioctl(5, LOOP_SET_FD, 3 [pid 394] <... futex resumed>) = 0 [ 23.747898][ T387] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 23.748582][ T370] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/2/file1 supports timestamps until 2038 (0x7fffffff) [ 23.758414][ T387] EXT4-fs (loop0): group descriptors corrupted! [pid 394] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 393] <... mount resumed>) = 0 [pid 394] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 393] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 392] <... ioctl resumed>) = 0 [pid 394] <... mprotect resumed>) = 0 [pid 393] <... futex resumed>) = 1 [pid 391] <... futex resumed>) = 0 [pid 393] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 392] close(3 [pid 391] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 394] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 391] <... futex resumed>) = 0 [pid 391] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 392] <... close resumed>) = 0 [pid 392] mkdir("./file1", 0777 [pid 393] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 393] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 3 [pid 394] <... clone resumed>, parent_tid=[395], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 395 [pid 392] <... mkdir resumed>) = 0 [pid 392] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 393] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 394] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 395 attached ) = 0 [pid 393] <... futex resumed>) = 1 [pid 391] <... futex resumed>) = 0 [pid 391] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 391] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 394] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 393] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 395] set_robust_list(0x7f35deb1e9e0, 24 [pid 394] <... futex resumed>) = 0 [pid 394] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 394] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 394] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[396], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 396 [pid 394] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 394] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 396 attached [pid 396] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 396] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 396] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 394] <... futex resumed>) = 0 [pid 394] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 394] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] <... futex resumed>) = 1 [pid 396] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 396] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 394] <... futex resumed>) = 0 [pid 394] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 394] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] <... futex resumed>) = 1 [pid 396] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 396] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 394] <... futex resumed>) = 0 [pid 394] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 394] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] <... futex resumed>) = 1 [pid 396] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 396] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 394] <... futex resumed>) = 0 [pid 396] <... futex resumed>) = 1 [pid 396] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 395] <... set_robust_list resumed>) = 0 [pid 395] memfd_create("syzkaller", 0) = 5 [pid 395] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 393] <... write resumed>) = 262144 [pid 393] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 392] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 393] <... futex resumed>) = 1 [pid 392] ioctl(5, LOOP_CLR_FD [pid 391] <... futex resumed>) = 0 [pid 393] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 392] <... ioctl resumed>) = 0 [pid 387] +++ exited with 0 +++ [pid 385] +++ exited with 0 +++ [pid 380] +++ exited with 0 +++ [pid 379] +++ exited with 0 +++ [pid 300] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 300] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=379, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... openat resumed>) = 3 [pid 300] <... openat resumed>) = 4 [pid 299] fstat(3, [pid 300] fstat(4, [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(3, [pid 300] getdents64(4, [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] getdents64(4, [pid 299] <... umount2 resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] close(4 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... close resumed>) = 0 [pid 299] lstat("./3/bus", [pid 300] rmdir("./2/file1" [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 299] unlink("./3/bus" [pid 300] getdents64(3, [pid 299] <... unlink resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] close(3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... close resumed>) = 0 [pid 299] lstat("./3/binderfs", [pid 300] rmdir("./2" [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 299] unlink("./3/binderfs" [pid 300] mkdir("./3", 0777 [pid 299] <... unlink resumed>) = 0 [pid 300] <... mkdir resumed>) = 0 [pid 299] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... openat resumed>) = 3 [pid 299] lstat("./3/file1", [pid 300] ioctl(3, LOOP_CLR_FD [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] close(3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... close resumed>) = 0 [pid 299] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... openat resumed>) = 4 [pid 299] fstat(4, [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 397 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./3/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./3") = 0 [pid 299] mkdir("./4", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=380, si_uid=0, si_status=0, si_utime=0, si_stime=9} --- [pid 299] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 398 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 295] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./3/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] unlink("./3/bus") = 0 [pid 295] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 392] close(5 [pid 297] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 392] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] lstat("./3/binderfs", [pid 392] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] lstat("./2/file1", [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 395] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 392] <... futex resumed>) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] unlink("./3/binderfs" [pid 392] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 391] exit_group(0 [pid 297] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... unlink resumed>) = 0 [pid 395] <... write resumed>) = 262144 [pid 393] <... futex resumed>) = ? [pid 392] <... futex resumed>) = ? [pid 391] <... exit_group resumed>) = ? [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 393] +++ exited with 0 +++ [pid 297] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... openat resumed>) = 4 [pid 295] lstat("./3/file1", [pid 297] fstat(4, [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(4, [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] getdents64(4, [pid 295] <... openat resumed>) = 4 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] fstat(4, [pid 297] close(4 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 395] munmap(0x7f35d66dd000, 262144 [pid 297] <... close resumed>) = 0 [pid 295] getdents64(4, [pid 395] <... munmap resumed>) = 0 [pid 297] rmdir("./2/file1" [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, [pid 395] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 297] <... rmdir resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 398 attached [pid 395] <... openat resumed>) = 6 [pid 297] getdents64(3, [pid 295] close(4 [pid 398] set_robust_list(0x555556c9c5e0, 24 [pid 295] <... close resumed>) = 0 [pid 398] <... set_robust_list resumed>) = 0 [pid 295] rmdir("./3/file1" [pid 398] chdir("./4" [pid 295] <... rmdir resumed>) = 0 [pid 398] <... chdir resumed>) = 0 [pid 295] getdents64(3, [pid 398] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 398] <... prctl resumed>) = 0 [pid 295] close(3 [pid 398] setpgid(0, 0 [pid 295] <... close resumed>) = 0 [pid 398] <... setpgid resumed>) = 0 [pid 295] rmdir("./3" [pid 398] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 395] ioctl(6, LOOP_SET_FD, 5 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 398] <... openat resumed>) = 3 [ 23.804329][ T392] loop3: detected capacity change from 0 to 512 [ 23.814178][ T392] EXT4-fs (loop3): VFS: Can't find ext4 filesystem [pid 295] mkdir("./4", 0777 [pid 398] write(3, "1000", 4 [pid 295] <... mkdir resumed>) = 0 [pid 398] <... write resumed>) = 4 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 398] close(3 [pid 295] <... openat resumed>) = 3 [pid 398] <... close resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 398] symlink("/dev/binderfs", "./binderfs" [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 398] <... symlink resumed>) = 0 [pid 295] close(3 [pid 398] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... close resumed>) = 0 [pid 398] <... futex resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 398] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 399 [pid 398] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 398] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[400], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 400 [pid 398] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 398] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 398] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 397 attached ) = 0x7f35deadd000 [pid 398] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 397] set_robust_list(0x555556c9c5e0, 24 [pid 398] <... mprotect resumed>) = 0 [pid 397] <... set_robust_list resumed>) = 0 [pid 398] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 397] chdir("./3") = 0 [pid 398] <... clone resumed>, parent_tid=[401], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 401 [pid 397] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 398] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 397] <... prctl resumed>) = 0 [pid 398] <... futex resumed>) = 0 [pid 397] setpgid(0, 0 [pid 297] close(3 [pid 398] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 397] <... setpgid resumed>) = 0 [pid 397] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... close resumed>) = 0 [pid 397] <... openat resumed>) = 3 [pid 297] rmdir("./2" [pid 397] write(3, "1000", 4) = 4 [pid 297] <... rmdir resumed>) = 0 [pid 392] +++ exited with 0 +++ [pid 391] +++ exited with 0 +++ [pid 397] close(3 [pid 297] mkdir("./3", 0777 [pid 397] <... close resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=391, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 397] symlink("/dev/binderfs", "./binderfs" [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 397] <... symlink resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 397] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 397] <... futex resumed>) = 0 [pid 298] <... restart_syscall resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 397] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 397] <... mmap resumed>) = 0x7f35deafe000 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 397] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 298] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] close(3./strace-static-x86_64: Process 401 attached ./strace-static-x86_64: Process 400 attached ./strace-static-x86_64: Process 399 attached [pid 397] <... mprotect resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... close resumed>) = 0 [pid 400] set_robust_list(0x7f35deb1e9e0, 24 [pid 397] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 401] set_robust_list(0x7f35deafd9e0, 24 [pid 400] <... set_robust_list resumed>) = 0 [pid 399] set_robust_list(0x555556c9c5e0, 24 [pid 298] <... openat resumed>) = 3 [pid 401] <... set_robust_list resumed>) = 0 [pid 400] memfd_create("syzkaller", 0 [pid 399] <... set_robust_list resumed>) = 0 [pid 397] <... clone resumed>, parent_tid=[402], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 402 [pid 298] fstat(3, [pid 401] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 400] <... memfd_create resumed>) = 3 [pid 397] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 403 [pid 400] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 399] chdir("./4" [pid 397] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 401] <... open resumed>) = 4 [pid 400] <... mmap resumed>) = 0x7f35d66dd000 [pid 399] <... chdir resumed>) = 0 [pid 397] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 401] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 400] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 399] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 397] <... futex resumed>) = 0 [pid 298] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 397] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... umount2 resumed>) = 0 [pid 397] <... mmap resumed>) = 0x7f35deadd000 [pid 298] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] <... write resumed>) = 262144 [pid 397] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 397] <... mprotect resumed>) = 0 [pid 298] lstat("./3/bus", [pid 397] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] unlink("./3/bus" [pid 397] <... clone resumed>, parent_tid=[404], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 404 [pid 298] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 404 attached ./strace-static-x86_64: Process 403 attached ./strace-static-x86_64: Process 402 attached [pid 401] <... futex resumed>) = 1 [pid 400] munmap(0x7f35d66dd000, 262144 [pid 399] <... prctl resumed>) = 0 [pid 398] <... futex resumed>) = 0 [pid 397] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 395] <... ioctl resumed>) = 0 [pid 298] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 404] set_robust_list(0x7f35deafd9e0, 24 [pid 403] set_robust_list(0x555556c9c5e0, 24 [pid 402] set_robust_list(0x7f35deb1e9e0, 24 [pid 401] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 400] <... munmap resumed>) = 0 [pid 399] setpgid(0, 0 [pid 398] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 397] <... futex resumed>) = 0 [pid 395] close(5 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 404] <... set_robust_list resumed>) = 0 [pid 403] <... set_robust_list resumed>) = 0 [pid 402] <... set_robust_list resumed>) = 0 [pid 401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 400] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 399] <... setpgid resumed>) = 0 [pid 398] <... futex resumed>) = 0 [pid 397] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 395] <... close resumed>) = 0 [pid 298] lstat("./3/binderfs", [pid 404] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 403] chdir("./3" [pid 402] memfd_create("syzkaller", 0 [pid 401] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 400] <... openat resumed>) = 5 [pid 399] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 398] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 395] mkdir("./file1", 0777 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 404] <... open resumed>) = 3 [pid 403] <... chdir resumed>) = 0 [pid 401] <... mount resumed>) = 0 [pid 400] ioctl(5, LOOP_SET_FD, 3 [pid 399] <... openat resumed>) = 3 [pid 298] unlink("./3/binderfs" [pid 404] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 402] <... memfd_create resumed>) = 4 [pid 401] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] write(3, "1000", 4 [pid 395] <... mkdir resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 404] <... futex resumed>) = 1 [pid 403] <... prctl resumed>) = 0 [pid 402] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 401] <... futex resumed>) = 1 [pid 399] <... write resumed>) = 4 [pid 398] <... futex resumed>) = 0 [pid 397] <... futex resumed>) = 0 [pid 395] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 298] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 404] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 403] setpgid(0, 0 [pid 402] <... mmap resumed>) = 0x7f35d66dd000 [pid 401] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 399] close(3 [pid 398] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 397] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 398] <... futex resumed>) = 0 [pid 397] <... futex resumed>) = 0 [pid 298] lstat("./3/file1", [pid 398] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 397] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./3/file1") = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./3") = 0 [pid 298] mkdir("./4", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 405 [pid 400] <... ioctl resumed>) = 0 [pid 400] close(3) = 0 ./strace-static-x86_64: Process 405 attached [pid 400] mkdir("./file1", 0777 [pid 405] set_robust_list(0x555556c9c5e0, 24 [pid 400] <... mkdir resumed>) = 0 [pid 405] <... set_robust_list resumed>) = 0 [pid 405] chdir("./4") = 0 [pid 405] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 405] setpgid(0, 0) = 0 [pid 405] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 400] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 405] <... openat resumed>) = 3 [pid 405] write(3, "1000", 4) = 4 [pid 405] close(3) = 0 [pid 405] symlink("/dev/binderfs", "./binderfs") = 0 [pid 405] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 405] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 405] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[406], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 406 [pid 405] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 405] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 405] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[407], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 407 [pid 405] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 407 attached [pid 407] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 407] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 407] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 407] <... futex resumed>) = 1 [pid 401] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 23.849926][ T395] loop1: detected capacity change from 0 to 512 [ 23.873639][ T400] loop4: detected capacity change from 0 to 512 [ 23.881719][ T395] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 23.881719][ T395] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 23.881719][ T395] [pid 404] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 403] <... setpgid resumed>) = 0 [pid 402] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 401] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 399] <... close resumed>) = 0 [pid 404] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 403] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 401] <... open resumed>) = 3 [pid 399] symlink("/dev/binderfs", "./binderfs" [pid 407] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 402] <... write resumed>) = 262144 [pid 399] <... symlink resumed>) = 0 [pid 404] <... mount resumed>) = 0 [pid 401] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 404] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] <... openat resumed>) = 3 [pid 402] munmap(0x7f35d66dd000, 262144 [pid 401] <... futex resumed>) = 1 [pid 399] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 398] <... futex resumed>) = 0 [pid 404] <... futex resumed>) = 1 [pid 403] write(3, "1000", 4 [pid 402] <... munmap resumed>) = 0 [pid 401] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 399] <... futex resumed>) = 0 [pid 398] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 397] <... futex resumed>) = 0 [pid 404] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 403] <... write resumed>) = 4 [pid 402] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 398] <... futex resumed>) = 0 [pid 397] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 398] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 397] <... futex resumed>) = 0 [pid 397] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 407] <... mount resumed>) = 0 [pid 407] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 407] <... futex resumed>) = 1 [pid 404] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 403] close(3 [pid 399] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 404] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 403] <... close resumed>) = 0 [pid 402] <... openat resumed>) = 5 [pid 399] <... mmap resumed>) = 0x7f35deafe000 [pid 404] <... open resumed>) = 6 [pid 403] symlink("/dev/binderfs", "./binderfs" [pid 402] ioctl(5, LOOP_SET_FD, 4 [pid 399] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 404] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] <... symlink resumed>) = 0 [pid 407] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 407] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 404] <... futex resumed>) = 1 [pid 403] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] <... mprotect resumed>) = 0 [pid 397] <... futex resumed>) = 0 [pid 397] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 397] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 405] <... futex resumed>) = 0 [pid 405] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 405] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 407] <... futex resumed>) = 1 [pid 407] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 407] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 405] <... futex resumed>) = 0 [pid 407] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 406 attached [pid 406] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 406] memfd_create("syzkaller", 0) = 5 [pid 406] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 406] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 404] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 406] <... write resumed>) = 262144 [pid 406] munmap(0x7f35d66dd000, 262144) = 0 [pid 406] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 6 [pid 406] ioctl(6, LOOP_SET_FD, 5 [pid 403] <... futex resumed>) = 0 [pid 399] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 403] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 403] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 399] <... clone resumed>, parent_tid=[408], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 408 [ 23.900343][ T400] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 23.900343][ T400] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 23.900343][ T400] [ 23.925179][ T402] loop5: detected capacity change from 0 to 512 [ 23.933711][ T404] blk_update_request: I/O error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 23.934834][ T406] loop3: detected capacity change from 0 to 512 [pid 403] <... mprotect resumed>) = 0 [pid 399] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 399] <... futex resumed>) = 0 [pid 399] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] <... clone resumed>, parent_tid=[409], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 409 [pid 399] <... futex resumed>) = 0 [pid 403] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 399] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 403] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] <... mmap resumed>) = 0x7f35deadd000 [pid 403] <... futex resumed>) = 0 [pid 399] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 403] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 399] <... mprotect resumed>) = 0 [pid 403] <... mmap resumed>) = 0x7f35deadd000 [pid 399] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 403] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 403] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 399] <... clone resumed>, parent_tid=[410], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 410 [pid 399] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] <... clone resumed>, parent_tid=[411], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 411 [pid 399] <... futex resumed>) = 0 [pid 403] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... futex resumed>) = 0 [pid 403] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 408 attached ./strace-static-x86_64: Process 409 attached [pid 401] <... write resumed>) = 262144 [pid 401] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 411 attached [pid 409] set_robust_list(0x7f35deb1e9e0, 24 [pid 411] set_robust_list(0x7f35deafd9e0, 24 [pid 408] set_robust_list(0x7f35deb1e9e0, 24 [pid 411] <... set_robust_list resumed>) = 0 [pid 408] <... set_robust_list resumed>) = 0 [pid 409] <... set_robust_list resumed>) = 0 [pid 411] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 409] memfd_create("syzkaller", 0 [pid 408] memfd_create("syzkaller", 0 [pid 411] <... open resumed>) = 3 [pid 409] <... memfd_create resumed>) = 4 [pid 408] <... memfd_create resumed>) = 3 [pid 409] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 408] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 401] <... futex resumed>) = 1 [pid 398] <... futex resumed>) = 0 [pid 408] <... mmap resumed>) = 0x7f35d66dd000 [pid 409] <... mmap resumed>) = 0x7f35d66dd000 [pid 411] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 403] <... futex resumed>) = 0 [pid 401] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 403] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 403] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 411] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 411] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 403] <... futex resumed>) = 0 [pid 403] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 410 attached [pid 403] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 402] <... ioctl resumed>) = 0 [pid 410] set_robust_list(0x7f35deafd9e0, 24 [pid 402] close(4 [pid 410] <... set_robust_list resumed>) = 0 [pid 402] <... close resumed>) = 0 [pid 410] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 402] mkdir("./file1", 0777 [pid 411] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 410] <... open resumed>) = 4 [pid 397] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 410] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... mkdir resumed>) = 0 [pid 397] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0} [pid 410] <... futex resumed>) = 1 [pid 402] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 399] <... futex resumed>) = 0 [pid 397] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 410] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 399] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] <... mount resumed>) = 0 [pid 399] <... futex resumed>) = 0 [pid 410] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 410] <... futex resumed>) = 0 [pid 411] <... open resumed>) = 5 [pid 409] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 408] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 399] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 411] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 411] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 408] <... write resumed>) = 262144 [pid 409] <... write resumed>) = 262144 [pid 409] munmap(0x7f35d66dd000, 262144 [pid 408] munmap(0x7f35d66dd000, 262144 [pid 410] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 409] <... munmap resumed>) = 0 [pid 408] <... munmap resumed>) = 0 [pid 403] <... futex resumed>) = 0 [pid 399] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 409] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 408] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 403] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] <... futex resumed>) = 0 [pid 411] <... futex resumed>) = 0 [pid 410] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 409] <... openat resumed>) = 6 [pid 408] <... openat resumed>) = 5 [pid 403] <... futex resumed>) = 1 [pid 399] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 411] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 410] <... open resumed>) = 6 [pid 409] ioctl(6, LOOP_SET_FD, 4 [pid 408] ioctl(5, LOOP_SET_FD, 3 [pid 406] <... ioctl resumed>) = 0 [ 23.978798][ T400] EXT4-fs (loop4): Magic mismatch, very weird! [ 23.978933][ T404] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 23.998323][ T402] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 23.998323][ T402] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 23.998323][ T402] [ 23.999150][ T408] loop0: detected capacity change from 0 to 512 [pid 404] <... write resumed>) = -1 EIO (Input/output error) [pid 403] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 400] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 411] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 410] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] close(5 [pid 404] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 400] ioctl(5, LOOP_CLR_FD [pid 410] <... futex resumed>) = 1 [pid 406] <... close resumed>) = 0 [pid 404] <... futex resumed>) = 0 [pid 400] <... ioctl resumed>) = 0 [pid 399] <... futex resumed>) = 0 [pid 410] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 406] mkdir("./file1", 0777 [pid 404] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 400] close(5 [pid 399] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 406] <... mkdir resumed>) = 0 [pid 400] <... close resumed>) = 0 [pid 399] <... futex resumed>) = 0 [pid 410] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 406] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 400] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 400] <... futex resumed>) = 0 [pid 400] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 398] exit_group(0 [pid 401] <... futex resumed>) = ? [pid 400] <... futex resumed>) = ? [pid 398] <... exit_group resumed>) = ? [pid 401] +++ exited with 0 +++ [pid 400] +++ exited with 0 +++ [pid 398] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=398, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 299] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 299] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 299] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./4/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] unlink("./4/bus") = 0 [pid 299] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./4/binderfs") = 0 [pid 299] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 299] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./4/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 411] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(3 [pid 411] <... futex resumed>) = 1 [pid 403] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 299] rmdir("./4") = 0 [pid 411] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] mkdir("./5", 0777) = 0 [ 24.019710][ T410] blk_update_request: I/O error, dev loop0, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 24.024152][ T395] EXT4-fs (loop1): 1 orphan inode deleted [ 24.042409][ T410] Buffer I/O error on dev loop0, logical block 0, lost async page write [ 24.050922][ T410] blk_update_request: I/O error, dev loop0, sector 8 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 24.054654][ T402] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 399] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 24.061902][ T410] Buffer I/O error on dev loop0, logical block 1, lost async page write [ 24.061936][ T410] blk_update_request: I/O error, dev loop0, sector 16 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 24.081048][ T409] loop2: detected capacity change from 0 to 512 [ 24.090893][ T410] Buffer I/O error on dev loop0, logical block 2, lost async page write [ 24.098139][ T406] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 24.098139][ T406] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 24.098139][ T406] [pid 408] <... ioctl resumed>) = 0 [ 24.104952][ T410] blk_update_request: I/O error, dev loop0, sector 24 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 24.124234][ T395] EXT4-fs (loop1): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 24.136117][ T410] Buffer I/O error on dev loop0, logical block 3, lost async page write [ 24.159810][ T395] ext4 filesystem being mounted at /root/syzkaller.5s3MMz/3/file1 supports timestamps until 2038 (0x7fffffff) [pid 299] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 409] <... ioctl resumed>) = 0 [pid 408] close(3 [pid 402] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 416 [pid 409] close(4 [pid 408] <... close resumed>) = 0 [pid 402] ioctl(5, LOOP_CLR_FD [pid 409] <... close resumed>) = 0 [pid 408] mkdir("./file1", 0777 [pid 402] <... ioctl resumed>) = 0 [pid 409] mkdir("./file1", 0777 [pid 408] <... mkdir resumed>) = 0 [pid 402] close(5 [pid 409] <... mkdir resumed>) = 0 [pid 402] <... close resumed>) = 0 [pid 409] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 408] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 402] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 397] exit_group(0) = ? [pid 404] <... futex resumed>) = ? [pid 404] +++ exited with 0 +++ [pid 395] <... mount resumed>) = 0 [pid 395] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 ./strace-static-x86_64: Process 416 attached [pid 410] <... write resumed>) = -1 EIO (Input/output error) [pid 416] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 416] chdir("./5") = 0 [pid 394] exit_group(0 [pid 396] <... futex resumed>) = ? [pid 394] <... exit_group resumed>) = ? [pid 396] +++ exited with 0 +++ [pid 416] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 416] setpgid(0, 0) = 0 [pid 416] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 416] write(3, "1000", 4) = 4 [pid 416] close(3) = 0 [pid 416] symlink("/dev/binderfs", "./binderfs") = 0 [pid 416] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 416] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 416] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 416] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[418], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 418 [pid 416] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 416] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 416] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 416] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 416] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[419], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 419 [pid 416] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 416] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 418 attached [pid 418] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 418] memfd_create("syzkaller", 0) = 3 [pid 418] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 418] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 418] munmap(0x7f35d66dd000, 262144) = 0 [ 24.167101][ T402] EXT4-fs (loop5): group descriptors corrupted! [ 24.190985][ T409] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 24.190985][ T409] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 24.190985][ T409] [ 24.192595][ T406] EXT4-fs (loop3): 1 orphan inode deleted [ 24.218846][ T408] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [pid 418] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 418] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 419 attached [pid 410] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 418] <... ioctl resumed>) = 0 [pid 418] close(3) = 0 [pid 418] mkdir("./file1", 0777) = 0 [pid 418] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 419] set_robust_list(0x7f35deafd9e0, 24 [pid 410] <... futex resumed>) = 0 [pid 410] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 402] +++ exited with 0 +++ [pid 397] +++ exited with 0 +++ [pid 395] +++ exited with 0 +++ [pid 394] +++ exited with 0 +++ [pid 416] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 416] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 416] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35d66fc000 [pid 416] mprotect(0x7f35d66fd000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 416] clone(child_stack=0x7f35d671c3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[421], tls=0x7f35d671c700, child_tidptr=0x7f35d671c9d0) = 421 [pid 416] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 416] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] <... mount resumed>) = 0 [pid 406] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 406] chdir("./file1") = 0 [pid 406] ioctl(6, LOOP_CLR_FD) = 0 [pid 406] close(6) = 0 [pid 406] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 24.218846][ T408] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 24.218846][ T408] [ 24.232839][ T418] loop4: detected capacity change from 0 to 512 [ 24.238112][ T406] EXT4-fs (loop3): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 24.266696][ T406] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/4/file1 supports timestamps until 2038 (0x7fffffff) [pid 406] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 419] <... set_robust_list resumed>) = 0 [pid 419] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 419] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 405] exit_group(0 [pid 407] <... futex resumed>) = ? [pid 406] <... futex resumed>) = ? [pid 405] <... exit_group resumed>) = ? [pid 407] +++ exited with 0 +++ [pid 406] +++ exited with 0 +++ [pid 405] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=397, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 300] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=405, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=394, si_uid=0, si_status=0, si_utime=0, si_stime=9} --- [pid 300] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 ./strace-static-x86_64: Process 421 attached [pid 300] fstat(3, [pid 421] set_robust_list(0x7f35d671c9e0, 24 [pid 298] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 421] <... set_robust_list resumed>) = 0 [pid 296] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 421] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 421] <... mount resumed>) = 0 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 408] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 421] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] getdents64(3, [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 421] <... futex resumed>) = 1 [pid 416] <... futex resumed>) = 0 [pid 408] ioctl(5, LOOP_CLR_FD [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] fstat(3, [pid 296] fstat(3, [pid 300] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 416] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 421] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 419] <... futex resumed>) = 0 [pid 416] <... futex resumed>) = 1 [pid 300] <... umount2 resumed>) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, [pid 408] <... ioctl resumed>) = 0 [pid 419] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 419] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 416] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 416] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = 0 [pid 416] <... futex resumed>) = 1 [pid 419] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 416] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 408] close(5 [pid 300] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(3, [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 408] <... close resumed>) = 0 [pid 300] lstat("./3/bus", [pid 298] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 408] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 408] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 419] <... write resumed>) = 262144 [pid 419] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 416] <... futex resumed>) = 0 [pid 399] exit_group(0 [pid 419] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 410] <... futex resumed>) = ? [pid 399] <... exit_group resumed>) = ? [pid 410] +++ exited with 0 +++ [pid 408] <... futex resumed>) = ? [pid 298] <... umount2 resumed>) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 300] unlink("./3/bus" [pid 298] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... unlink resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] lstat("./4/bus", [pid 296] lstat("./3/bus", [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] unlink("./4/bus" [pid 408] +++ exited with 0 +++ [pid 399] +++ exited with 0 +++ [pid 296] unlink("./3/bus") = 0 [pid 296] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./3/binderfs") = 0 [pid 296] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] lstat("./3/binderfs", [pid 298] <... unlink resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=399, si_uid=0, si_status=0, si_utime=0, si_stime=17} --- [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] unlink("./3/binderfs") = 0 [pid 300] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./3/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 300] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] close(4) = 0 [pid 300] rmdir("./3/file1") = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] close(3) = 0 [pid 300] rmdir("./3") = 0 [pid 300] mkdir("./4", 0777) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 300] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 300] close(3) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 424 [pid 298] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./4/binderfs", [pid 295] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 295] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 ./strace-static-x86_64: Process 424 attached [pid 418] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 298] unlink("./4/binderfs" [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... unlink resumed>) = 0 [pid 295] lstat("./4/bus", [pid 298] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [ 24.275437][ T418] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 24.275437][ T418] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 24.275437][ T418] [ 24.298577][ T408] EXT4-fs warning (device loop0): read_mmp_block:115: Error -117 while reading MMP block 8 [ 24.321095][ T418] EXT4-fs warning (device loop4): read_mmp_block:115: Error -117 while reading MMP block 8 [pid 295] unlink("./4/bus" [pid 424] set_robust_list(0x555556c9c5e0, 24 [pid 295] <... unlink resumed>) = 0 [pid 295] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./4/binderfs") = 0 [pid 295] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./4/file1") = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./4" [pid 424] <... set_robust_list resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 295] mkdir("./5", 0777 [pid 424] chdir("./4") = 0 [pid 295] <... mkdir resumed>) = 0 [pid 424] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 424] setpgid(0, 0) = 0 [pid 424] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 424] write(3, "1000", 4) = 4 [pid 424] close(3) = 0 [pid 424] symlink("/dev/binderfs", "./binderfs") = 0 [pid 424] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 424] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 424] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[425], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 425 [pid 424] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 424] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 424] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[426], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 426 [pid 424] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 424] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 418] ioctl(4, LOOP_CLR_FD) = 0 [pid 418] close(4./strace-static-x86_64: Process 426 attached ./strace-static-x86_64: Process 425 attached ) = 0 [pid 409] <... mount resumed>) = 0 [pid 425] set_robust_list(0x7f35deb1e9e0, 24 [pid 409] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 425] <... set_robust_list resumed>) = 0 [pid 409] <... openat resumed>) = 4 [pid 425] memfd_create("syzkaller", 0 [pid 409] chdir("./file1" [pid 425] <... memfd_create resumed>) = 3 [pid 409] <... chdir resumed>) = 0 [pid 426] set_robust_list(0x7f35deafd9e0, 24 [pid 425] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 418] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 409] ioctl(6, LOOP_CLR_FD [pid 426] <... set_robust_list resumed>) = 0 [pid 425] <... mmap resumed>) = 0x7f35d66dd000 [pid 418] <... futex resumed>) = 0 [pid 409] <... ioctl resumed>) = 0 [pid 409] close(6 [pid 416] exit_group(0 [pid 426] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 425] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 418] write(3, 0x7f35d66dd000, 262144 [pid 409] <... close resumed>) = 0 [pid 426] <... open resumed>) = 4 [pid 425] <... write resumed>) = 262144 [pid 421] <... futex resumed>) = ? [pid 419] <... futex resumed>) = ? [pid 418] +++ exited with 0 +++ [pid 416] <... exit_group resumed>) = ? [pid 409] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 426] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] +++ exited with 0 +++ [pid 419] +++ exited with 0 +++ [pid 409] <... futex resumed>) = 0 [pid 426] <... futex resumed>) = 1 [pid 424] <... futex resumed>) = 0 [pid 409] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 403] exit_group(0 [pid 426] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 425] munmap(0x7f35d66dd000, 262144 [pid 411] <... futex resumed>) = ? [pid 409] <... futex resumed>) = ? [pid 403] <... exit_group resumed>) = ? [pid 425] <... munmap resumed>) = 0 [pid 411] +++ exited with 0 +++ [pid 409] +++ exited with 0 +++ [pid 403] +++ exited with 0 +++ [pid 425] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=403, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 425] <... openat resumed>) = 5 [pid 425] ioctl(5, LOOP_SET_FD, 3 [pid 424] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 426] <... futex resumed>) = 0 [pid 424] <... futex resumed>) = 1 [ 24.336759][ T409] EXT4-fs (loop2): 1 orphan inode deleted [ 24.342482][ T409] EXT4-fs (loop2): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 24.365515][ T409] ext4 filesystem being mounted at /root/syzkaller.7ngmbG/3/file1 supports timestamps until 2038 (0x7fffffff) [pid 426] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 424] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 426] <... mount resumed>) = 0 [pid 426] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 424] <... futex resumed>) = 0 [pid 426] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 424] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 426] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 424] <... futex resumed>) = 0 [pid 426] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 424] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... openat resumed>) = 3 [pid 297] getdents64(3, [pid 295] ioctl(3, LOOP_CLR_FD [pid 426] <... open resumed>) = 6 [pid 425] <... ioctl resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 426] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] close(3 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 426] <... futex resumed>) = 1 [pid 425] <... close resumed>) = 0 [pid 424] <... futex resumed>) = 0 [pid 295] close(3 [pid 426] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 425] mkdir("./file1", 0777 [pid 424] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = 0 [pid 426] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 424] <... futex resumed>) = 0 [pid 297] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... close resumed>) = 0 [pid 426] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 424] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] lstat("./3/bus", [pid 425] <... mkdir resumed>) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] unlink("./3/bus" [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 427 [pid 425] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 297] <... unlink resumed>) = 0 [pid 297] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 427 attached ) = -1 EINVAL (Invalid argument) [pid 297] lstat("./3/binderfs", [pid 427] set_robust_list(0x555556c9c5e0, 24 [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 427] <... set_robust_list resumed>) = 0 [pid 297] unlink("./3/binderfs" [pid 427] chdir("./5") = 0 [pid 297] <... unlink resumed>) = 0 [pid 297] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 427] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 427] setpgid(0, 0) = 0 [pid 427] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 427] write(3, "1000", 4) = 4 [pid 427] close(3) = 0 [pid 427] symlink("/dev/binderfs", "./binderfs") = 0 [pid 427] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 426] <... write resumed>) = 262144 [pid 426] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 424] <... futex resumed>) = 0 [pid 427] <... futex resumed>) = 0 [pid 426] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 427] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 427] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 427] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[428], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 428 [pid 427] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 427] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 427] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[429], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 429 [pid 427] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 429 attached [pid 429] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 429] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 429] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 429] <... futex resumed>) = 1 [pid 429] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 429] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 429] <... futex resumed>) = 1 [pid 429] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 429] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 427] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 427] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 429] <... futex resumed>) = 1 [pid 429] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 429] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 429] <... futex resumed>) = 1 [pid 429] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 428 attached [pid 428] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 428] memfd_create("syzkaller", 0) = 5 [pid 428] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 296] <... umount2 resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 298] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./4/file1", [pid 425] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./3/file1", [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 425] ioctl(5, LOOP_CLR_FD [pid 298] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 425] <... ioctl resumed>) = 0 [pid 298] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 425] close(5 [pid 298] <... openat resumed>) = 4 [pid 296] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] fstat(4, [pid 425] <... close resumed>) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... openat resumed>) = 4 [pid 425] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(4, [pid 296] fstat(4, [pid 424] exit_group(0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 426] <... futex resumed>) = ? [pid 424] <... exit_group resumed>) = ? [pid 426] +++ exited with 0 +++ [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, [pid 425] <... futex resumed>) = ? [pid 298] getdents64(4, [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] getdents64(4, [pid 298] close(4 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] <... close resumed>) = 0 [pid 296] close(4 [pid 298] rmdir("./4/file1" [pid 296] <... close resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 296] rmdir("./3/file1" [pid 298] getdents64(3, [pid 296] <... rmdir resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] getdents64(3, [pid 298] close(3) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] rmdir("./4" [pid 296] close(3 [pid 298] <... rmdir resumed>) = 0 [pid 298] mkdir("./5", 0777 [pid 296] <... close resumed>) = 0 [pid 428] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 298] <... mkdir resumed>) = 0 [pid 296] rmdir("./3" [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] <... rmdir resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 296] mkdir("./4", 0777) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 296] <... openat resumed>) = 3 [pid 298] <... close resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 430 attached , child_tidptr=0x555556c9c5d0) = 430 [pid 430] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 428] <... write resumed>) = 262144 [pid 430] chdir("./5" [pid 428] munmap(0x7f35d66dd000, 262144 [pid 430] <... chdir resumed>) = 0 [pid 430] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 430] setpgid(0, 0) = 0 [pid 430] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 430] write(3, "1000", 4 [pid 428] <... munmap resumed>) = 0 [pid 416] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=416, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 299] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 299] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./5/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] unlink("./5/bus") = 0 [pid 299] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./5/binderfs") = 0 [pid 299] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... umount2 resumed>) = 0 [pid 299] <... openat resumed>) = 4 [pid 299] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./5/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./5") = 0 [pid 299] mkdir("./6", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 297] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 430] <... write resumed>) = 4 [pid 428] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 430] close(3 [pid 428] <... openat resumed>) = 6 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] lstat("./3/file1", [pid 430] <... close resumed>) = 0 [pid 428] ioctl(6, LOOP_SET_FD, 5 [pid 299] close(3 [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 430] symlink("/dev/binderfs", "./binderfs" [pid 299] <... close resumed>) = 0 [pid 297] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 431 ./strace-static-x86_64: Process 431 attached [pid 431] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 431] chdir("./6") = 0 [pid 431] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 431] setpgid(0, 0) = 0 [pid 431] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 431] write(3, "1000", 4) = 4 [pid 431] close(3) = 0 [pid 431] symlink("/dev/binderfs", "./binderfs") = 0 [pid 431] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 431] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 431] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 431] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[432], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 432 [pid 431] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 431] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 431] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 431] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 430] <... symlink resumed>) = 0 ./strace-static-x86_64: Process 432 attached [pid 431] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 430] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 428] <... ioctl resumed>) = 0 [pid 297] <... openat resumed>) = 4 [pid 430] <... futex resumed>) = 0 [pid 428] close(5 [pid 297] fstat(4, [pid 432] set_robust_list(0x7f35deb1e9e0, 24 [pid 430] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 428] <... close resumed>) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 ./strace-static-x86_64: Process 433 attached [pid 430] <... mmap resumed>) = 0x7f35deafe000 [pid 428] mkdir("./file1", 0777 [pid 432] <... set_robust_list resumed>) = 0 [pid 297] getdents64(4, [pid 431] <... clone resumed>, parent_tid=[433], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 433 [pid 430] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 428] <... mkdir resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 432] memfd_create("syzkaller", 0 [pid 430] <... mprotect resumed>) = 0 [ 24.385327][ T425] loop5: detected capacity change from 0 to 512 [ 24.399491][ T425] EXT4-fs (loop5): VFS: Can't find ext4 filesystem [ 24.426900][ T428] loop0: detected capacity change from 0 to 512 [pid 428] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 297] getdents64(4, [pid 433] set_robust_list(0x7f35deafd9e0, 24 [pid 432] <... memfd_create resumed>) = 3 [pid 431] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 433] <... set_robust_list resumed>) = 0 [pid 432] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 431] <... futex resumed>) = 0 [pid 433] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 432] <... mmap resumed>) = 0x7f35d66dd000 [pid 431] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 433] <... open resumed>) = 4 [pid 432] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 433] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 432] <... write resumed>) = 262144 [pid 433] <... futex resumed>) = 1 [pid 432] munmap(0x7f35d66dd000, 262144 [pid 431] <... futex resumed>) = 0 [pid 433] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 432] <... munmap resumed>) = 0 [pid 431] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 432] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 431] <... futex resumed>) = 0 [pid 433] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 432] <... openat resumed>) = 5 [pid 431] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 433] <... mount resumed>) = 0 [pid 432] ioctl(5, LOOP_SET_FD, 3 [pid 433] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] +++ exited with 0 +++ [pid 424] +++ exited with 0 +++ [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] <... ioctl resumed>) = 0 [pid 433] <... futex resumed>) = 1 [pid 431] <... futex resumed>) = 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=424, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 433] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 431] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] close(4 [pid 431] <... futex resumed>) = 0 [pid 430] <... clone resumed>, parent_tid=[434], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 434 [pid 296] close(3 [pid 431] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 430] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... close resumed>) = 0 [pid 430] <... futex resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... close resumed>) = 0 [pid 300] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 300] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 430] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = 0 [pid 297] rmdir("./3/file1" [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 430] <... futex resumed>) = 0 [pid 300] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./4/bus", [pid 430] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 300] unlink("./4/bus" [pid 430] <... mmap resumed>) = 0x7f35deadd000 [pid 300] <... unlink resumed>) = 0 [pid 297] getdents64(3, [pid 430] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 300] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 430] <... mprotect resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 435 [pid 430] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 300] lstat("./4/binderfs", [pid 297] close(3 [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 430] <... clone resumed>, parent_tid=[436], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 436 [pid 300] unlink("./4/binderfs" [pid 297] <... close resumed>) = 0 [pid 430] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... unlink resumed>) = 0 [pid 430] <... futex resumed>) = 0 [pid 300] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] rmdir("./3"./strace-static-x86_64: Process 436 attached ./strace-static-x86_64: Process 435 attached ./strace-static-x86_64: Process 434 attached [pid 430] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 436] set_robust_list(0x7f35deafd9e0, 24 [pid 300] lstat("./4/file1", [pid 297] <... rmdir resumed>) = 0 [pid 436] <... set_robust_list resumed>) = 0 [pid 435] set_robust_list(0x555556c9c5e0, 24 [pid 434] set_robust_list(0x7f35deb1e9e0, 24 [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] mkdir("./4", 0777 [pid 436] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 435] <... set_robust_list resumed>) = 0 [pid 434] <... set_robust_list resumed>) = 0 [pid 300] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] <... mkdir resumed>) = 0 [pid 436] <... open resumed>) = 3 [pid 300] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 436] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] chdir("./4" [pid 434] memfd_create("syzkaller", 0 [pid 300] <... openat resumed>) = 4 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 436] <... futex resumed>) = 1 [pid 435] <... chdir resumed>) = 0 [pid 434] <... memfd_create resumed>) = 4 [pid 430] <... futex resumed>) = 0 [pid 300] fstat(4, [pid 436] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 435] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 434] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 433] <... open resumed>) = 6 [pid 432] <... ioctl resumed>) = 0 [pid 430] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... openat resumed>) = 3 [pid 433] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] getdents64(4, [pid 433] <... futex resumed>) = 1 [pid 431] <... futex resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 433] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 431] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] getdents64(4, [pid 433] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 431] <... futex resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 433] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 431] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] close(4 [pid 436] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 435] <... prctl resumed>) = 0 [pid 434] <... mmap resumed>) = 0x7f35d66dd000 [pid 433] <... write resumed>) = 262144 [pid 430] <... futex resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 436] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 433] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] rmdir("./4/file1" [pid 436] <... mount resumed>) = 0 [pid 433] <... futex resumed>) = 1 [pid 431] <... futex resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 436] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] getdents64(3, [pid 436] <... futex resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 436] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] close(3) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 430] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] setpgid(0, 0 [pid 300] rmdir("./4") = 0 [pid 300] mkdir("./5", 0777) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 434] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 300] <... openat resumed>) = 3 [pid 435] <... setpgid resumed>) = 0 [pid 430] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] ioctl(3, LOOP_CLR_FD [pid 297] close(3 [pid 435] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 430] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 435] <... openat resumed>) = 3 [pid 300] close(3 [pid 297] <... close resumed>) = 0 [pid 436] <... futex resumed>) = 0 [pid 430] <... futex resumed>) = 1 [pid 300] <... close resumed>) = 0 [pid 436] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 435] write(3, "1000", 4 [pid 430] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 436] <... open resumed>) = 5 [pid 436] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] <... write resumed>) = 4 [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 438 [pid 436] <... futex resumed>) = 1 [pid 436] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 435] close(3 [pid 434] <... write resumed>) = 262144 [pid 430] <... futex resumed>) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 439 [pid 430] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 436] <... futex resumed>) = 0 [pid 430] <... futex resumed>) = 1 [pid 436] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 430] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 436] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 435] <... close resumed>) = 0 [pid 436] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] symlink("/dev/binderfs", "./binderfs" [pid 436] <... futex resumed>) = 1 [pid 435] <... symlink resumed>) = 0 [pid 430] <... futex resumed>) = 0 [pid 436] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 435] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] munmap(0x7f35d66dd000, 262144 [pid 435] <... futex resumed>) = 0 [pid 435] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 434] <... munmap resumed>) = 0 [pid 435] <... mmap resumed>) = 0x7f35deafe000 [pid 435] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 434] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 435] <... mprotect resumed>) = 0 [ 24.436573][ T428] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 24.436573][ T428] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 24.436573][ T428] [ 24.452310][ T432] loop4: detected capacity change from 0 to 512 [pid 435] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 434] <... openat resumed>) = 6 ./strace-static-x86_64: Process 439 attached ./strace-static-x86_64: Process 438 attached [pid 432] close(3 [pid 439] set_robust_list(0x555556c9c5e0, 24 [pid 434] ioctl(6, LOOP_SET_FD, 4 [pid 432] <... close resumed>) = 0 [pid 439] <... set_robust_list resumed>) = 0 [pid 435] <... clone resumed>, parent_tid=[441], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 441 ./strace-static-x86_64: Process 441 attached [pid 441] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 441] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 438] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 438] chdir("./5") = 0 [pid 438] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 438] setpgid(0, 0) = 0 [pid 438] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 438] write(3, "1000", 4) = 4 [pid 438] close(3) = 0 [pid 438] symlink("/dev/binderfs", "./binderfs") = 0 [pid 438] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 438] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 438] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[442], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 442 [pid 435] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 438] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 438] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 438] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 441] <... futex resumed>) = 0 [pid 435] <... futex resumed>) = 1 [pid 441] memfd_create("syzkaller", 0 [pid 438] <... clone resumed>, parent_tid=[444], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 444 [pid 441] <... memfd_create resumed>) = 3 [pid 438] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 441] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 438] <... futex resumed>) = 0 [pid 441] <... mmap resumed>) = 0x7f35d66fe000 [pid 438] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 441] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 435] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 441] <... write resumed>) = 262144 [pid 435] <... futex resumed>) = 0 [pid 441] munmap(0x7f35d66fe000, 262144 [pid 435] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 441] <... munmap resumed>) = 0 [pid 435] <... mmap resumed>) = 0x7f35d66dd000 [pid 432] mkdir("./file1", 0777 [pid 441] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 435] mprotect(0x7f35d66de000, 131072, PROT_READ|PROT_WRITE [pid 441] <... openat resumed>) = 4 [pid 435] <... mprotect resumed>) = 0 [pid 441] ioctl(4, LOOP_SET_FD, 3 [pid 435] clone(child_stack=0x7f35d66fd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 445 attached ./strace-static-x86_64: Process 442 attached [pid 439] chdir("./4" [pid 434] <... ioctl resumed>) = 0 [pid 432] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 444 attached [pid 444] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 444] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 444] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 438] <... futex resumed>) = 0 [pid 444] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 438] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... mount resumed>) = 0 [pid 438] <... futex resumed>) = 0 [pid 444] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 444] <... futex resumed>) = 0 [pid 438] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 444] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 438] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 438] <... futex resumed>) = 0 [pid 445] set_robust_list(0x7f35d66fd9e0, 24 [pid 444] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 442] set_robust_list(0x7f35deb1e9e0, 24 [pid 439] <... chdir resumed>) = 0 [pid 438] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] <... clone resumed>, parent_tid=[445], tls=0x7f35d66fd700, child_tidptr=0x7f35d66fd9d0) = 445 [pid 434] close(4 [pid 432] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 444] <... open resumed>) = 4 [pid 444] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 438] <... futex resumed>) = 0 [pid 444] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 438] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 438] <... futex resumed>) = 0 [pid 444] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 438] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 444] <... futex resumed>) = 0 [pid 438] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 444] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 441] <... ioctl resumed>) = 0 [pid 441] close(3) = 0 [pid 441] mkdir("./file1", 0777) = 0 [ 24.501285][ T434] loop3: detected capacity change from 0 to 512 [ 24.517947][ T441] loop1: detected capacity change from 0 to 512 [ 24.521659][ T428] EXT4-fs (loop0): 1 orphan inode deleted [pid 441] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 445] <... set_robust_list resumed>) = 0 [pid 442] <... set_robust_list resumed>) = 0 [pid 439] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 435] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... close resumed>) = 0 [pid 445] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 442] memfd_create("syzkaller", 0 [pid 439] <... prctl resumed>) = 0 [pid 435] <... futex resumed>) = 0 [pid 434] mkdir("./file1", 0777 [pid 445] <... open resumed>) = 3 [pid 442] <... memfd_create resumed>) = 5 [pid 439] setpgid(0, 0 [pid 435] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 434] <... mkdir resumed>) = 0 [pid 445] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 442] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 439] <... setpgid resumed>) = 0 [pid 435] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 434] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 445] <... futex resumed>) = 0 [pid 442] <... mmap resumed>) = 0x7f35d66dd000 [pid 439] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 435] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 428] <... mount resumed>) = 0 [pid 428] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 428] chdir("./file1") = 0 [pid 428] ioctl(6, LOOP_CLR_FD) = 0 [pid 428] close(6) = 0 [pid 428] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 428] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 442] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 439] <... openat resumed>) = 3 [pid 435] <... futex resumed>) = 0 [ 24.530273][ T428] EXT4-fs (loop0): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 24.553298][ T428] ext4 filesystem being mounted at /root/syzkaller.d28Auw/5/file1 supports timestamps until 2038 (0x7fffffff) [ 24.557147][ T434] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 24.557147][ T434] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 24.557147][ T434] [ 24.567781][ T441] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 24.567781][ T441] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 24.567781][ T441] [pid 427] exit_group(0 [pid 445] <... mount resumed>) = 0 [pid 442] <... write resumed>) = 262144 [pid 439] write(3, "1000", 4 [pid 435] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 427] <... exit_group resumed>) = ? [pid 439] <... write resumed>) = 4 [pid 429] <... futex resumed>) = ? [pid 428] <... futex resumed>) = ? [pid 429] +++ exited with 0 +++ [pid 428] +++ exited with 0 +++ [pid 427] +++ exited with 0 +++ [pid 432] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 432] ioctl(5, LOOP_CLR_FD) = 0 [pid 432] close(5) = 0 [pid 432] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 445] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 442] munmap(0x7f35d66dd000, 262144) = 0 [pid 442] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 6 [pid 442] ioctl(6, LOOP_SET_FD, 5 [pid 439] close(3 [pid 435] <... futex resumed>) = 0 [pid 439] <... close resumed>) = 0 [pid 431] exit_group(0 [pid 435] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=427, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 445] <... futex resumed>) = 0 [pid 439] symlink("/dev/binderfs", "./binderfs" [pid 435] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 433] <... futex resumed>) = ? [pid 431] <... exit_group resumed>) = ? [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 445] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 439] <... symlink resumed>) = 0 [pid 433] +++ exited with 0 +++ [pid 295] <... restart_syscall resumed>) = 0 [pid 445] <... open resumed>) = 5 [pid 439] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 445] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] <... futex resumed>) = 0 [pid 445] <... futex resumed>) = 1 [pid 435] <... futex resumed>) = 0 [pid 439] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 445] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 435] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] <... mmap resumed>) = 0x7f35deafe000 [pid 295] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 445] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 439] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 445] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 435] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 439] <... mprotect resumed>) = 0 [pid 442] <... ioctl resumed>) = 0 [pid 442] close(5) = 0 [pid 442] mkdir("./file1", 0777) = 0 [pid 442] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 432] <... futex resumed>) = ? [pid 435] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 445] <... write resumed>) = 262144 [pid 439] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 295] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 445] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... openat resumed>) = 3 [pid 441] <... mount resumed>) = -1 EINVAL (Invalid argument) [ 24.590007][ T432] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 24.612024][ T442] loop5: detected capacity change from 0 to 512 [ 24.622639][ T441] EXT4-fs (loop1): Magic mismatch, very weird! [ 24.624848][ T434] EXT4-fs (loop3): 1 orphan inode deleted [ 24.629219][ T442] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 24.629219][ T442] Contact linux-ext4@vger.kernel.org if you think we should keep it. [pid 441] ioctl(4, LOOP_CLR_FD) = 0 [pid 441] close(4) = 0 [pid 441] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 435] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 295] fstat(3, ./strace-static-x86_64: Process 448 attached [pid 435] exit_group(0 [pid 439] <... clone resumed>, parent_tid=[448], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 448 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 448] set_robust_list(0x7f35deb1e9e0, 24 [pid 435] <... exit_group resumed>) = ? [pid 441] <... futex resumed>) = ? [pid 295] getdents64(3, [pid 441] +++ exited with 0 +++ [pid 439] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 445] <... futex resumed>) = 136 [pid 439] <... futex resumed>) = 0 [pid 295] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 439] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 439] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 439] <... mmap resumed>) = 0x7f35deadd000 [pid 439] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 439] <... mprotect resumed>) = 0 [pid 295] lstat("./5/bus", [pid 439] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] unlink("./5/bus" [pid 439] <... clone resumed>, parent_tid=[449], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 449 [pid 295] <... unlink resumed>) = 0 [pid 439] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 439] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 439] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] lstat("./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./5/binderfs" [pid 448] <... set_robust_list resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 295] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 434] <... mount resumed>) = 0 [pid 434] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 434] chdir("./file1") = 0 [pid 448] memfd_create("syzkaller", 0) = 3 [pid 434] ioctl(6, LOOP_CLR_FD [pid 448] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 434] <... ioctl resumed>) = 0 [pid 434] close(6) = 0 [pid 434] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 430] exit_group(0 [pid 436] <... futex resumed>) = ? [pid 430] <... exit_group resumed>) = ? [pid 436] +++ exited with 0 +++ ./strace-static-x86_64: Process 449 attached [pid 449] set_robust_list(0x7f35deafd9e0, 24 [pid 448] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 449] <... set_robust_list resumed>) = 0 [pid 449] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 448] <... write resumed>) = 262144 [pid 449] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 448] munmap(0x7f35d66dd000, 262144 [pid 449] <... futex resumed>) = 1 [pid 439] <... futex resumed>) = 0 [pid 449] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 448] <... munmap resumed>) = 0 [pid 439] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 449] <... mount resumed>) = 0 [pid 448] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 449] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 449] <... futex resumed>) = 0 [pid 448] <... openat resumed>) = 5 [pid 439] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 449] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] ioctl(5, LOOP_SET_FD, 3 [pid 439] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 449] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 439] <... futex resumed>) = 0 [pid 449] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 439] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 434] +++ exited with 0 +++ [pid 430] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=430, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 298] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 298] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [ 24.629219][ T442] [ 24.634446][ T434] EXT4-fs (loop3): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 24.676668][ T434] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/5/file1 supports timestamps until 2038 (0x7fffffff) [pid 298] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 449] <... open resumed>) = 6 [pid 448] <... ioctl resumed>) = 0 [pid 449] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 439] <... futex resumed>) = 0 [pid 449] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 439] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 439] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 449] <... write resumed>) = 262144 [pid 449] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] <... futex resumed>) = 0 [pid 449] <... futex resumed>) = 1 [pid 449] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... umount2 resumed>) = 0 [pid 448] close(3) = 0 [pid 448] mkdir("./file1", 0777) = 0 [pid 448] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 298] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 442] <... mount resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./5/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] unlink("./5/bus") = 0 [pid 298] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] unlink("./5/binderfs") = 0 [pid 298] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 442] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 442] chdir("./file1") = 0 [pid 442] ioctl(6, LOOP_CLR_FD) = 0 [pid 442] close(6) = 0 [pid 442] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 442] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 438] exit_group(0) = ? [pid 442] <... futex resumed>) = ? [pid 442] +++ exited with 0 +++ [pid 444] <... futex resumed>) = ? [pid 444] +++ exited with 0 +++ [pid 438] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=438, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 300] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 448] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 448] ioctl(5, LOOP_CLR_FD) = 0 [pid 300] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 300] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 300] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./5/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] unlink("./5/bus") = 0 [pid 300] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] unlink("./5/binderfs" [pid 448] close(5) = 0 [pid 300] <... unlink resumed>) = 0 [pid 300] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 448] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 448] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 439] exit_group(0 [pid 449] <... futex resumed>) = ? [pid 439] <... exit_group resumed>) = ? [pid 449] +++ exited with 0 +++ [pid 448] <... futex resumed>) = ? [pid 445] +++ exited with 0 +++ [pid 435] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=435, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 295] <... umount2 resumed>) = 0 [pid 296] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 432] +++ exited with 0 +++ [pid 431] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=431, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 299] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 299] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 295] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] lstat("./6/bus", [pid 298] lstat("./5/file1", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] lstat("./5/file1", [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] lstat("./4/bus", [pid 299] unlink("./6/bus" [pid 298] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... unlink resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] unlink("./4/bus" [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... openat resumed>) = 4 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] lstat("./6/binderfs", [pid 298] fstat(4, [pid 296] <... unlink resumed>) = 0 [pid 295] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] unlink("./6/binderfs" [pid 298] getdents64(4, [pid 295] <... openat resumed>) = 4 [pid 299] <... unlink resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] fstat(4, [pid 299] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(4, [pid 296] lstat("./4/binderfs", [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] lstat("./6/file1", [pid 298] close(4 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] getdents64(4, [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... close resumed>) = 0 [pid 296] unlink("./4/binderfs" [pid 299] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] rmdir("./5/file1" [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... rmdir resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] getdents64(4, [pid 299] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] getdents64(3, [pid 296] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] <... openat resumed>) = 4 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] close(4 [pid 299] fstat(4, [pid 298] close(3 [pid 296] lstat("./4/file1", [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... close resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... close resumed>) = 0 [pid 299] getdents64(4, [pid 298] rmdir("./5" [pid 296] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] rmdir("./5/file1" [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] <... rmdir resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] mkdir("./6", 0777 [pid 299] getdents64(4, [pid 296] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... rmdir resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 296] <... openat resumed>) = 4 [pid 295] getdents64(3, [pid 299] close(4 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] fstat(4, [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] <... close resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] close(3 [pid 299] rmdir("./6/file1" [pid 298] ioctl(3, LOOP_CLR_FD [pid 296] getdents64(4, [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... close resumed>) = 0 [pid 298] close(3) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] getdents64(3, [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] rmdir("./5"./strace-static-x86_64: Process 452 attached [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] getdents64(4, [pid 452] set_robust_list(0x555556c9c5e0, 24 [pid 299] close(3 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 452 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 452] <... set_robust_list resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 296] close(4 [pid 295] mkdir("./6", 0777 [pid 452] chdir("./6" [pid 299] rmdir("./6" [pid 296] <... close resumed>) = 0 [pid 452] <... chdir resumed>) = 0 [pid 452] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 452] setpgid(0, 0 [pid 295] <... mkdir resumed>) = 0 [pid 452] <... setpgid resumed>) = 0 [pid 452] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] <... rmdir resumed>) = 0 [pid 296] rmdir("./4/file1" [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 299] mkdir("./7", 0777 [pid 452] <... openat resumed>) = 3 [pid 452] write(3, "1000", 4 [pid 296] <... rmdir resumed>) = 0 [pid 452] <... write resumed>) = 4 [pid 452] close(3) = 0 [pid 452] symlink("/dev/binderfs", "./binderfs") = 0 [pid 299] <... mkdir resumed>) = 0 [pid 296] getdents64(3, [pid 295] <... openat resumed>) = 3 [pid 452] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 452] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] close(3 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 452] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 296] <... close resumed>) = 0 [pid 295] close(3 [pid 452] <... mmap resumed>) = 0x7f35deafe000 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] rmdir("./4" [pid 452] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 299] close(3 [pid 295] <... close resumed>) = 0 [pid 452] <... mprotect resumed>) = 0 [pid 452] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] <... rmdir resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... close resumed>) = 0 [pid 296] mkdir("./5", 0777 [pid 452] <... clone resumed>, parent_tid=[453], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 453 [pid 452] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 452] <... futex resumed>) = 0 [pid 452] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 452] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 452] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] <... mkdir resumed>) = 0 [pid 452] <... clone resumed>, parent_tid=[455], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 455 [pid 452] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 454 [pid 452] <... futex resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 456 [pid 452] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... openat resumed>) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3./strace-static-x86_64: Process 453 attached ) = 0 [pid 453] set_robust_list(0x7f35deb1e9e0, 24 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 453] <... set_robust_list resumed>) = 0 [pid 453] memfd_create("syzkaller", 0 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 457 ./strace-static-x86_64: Process 457 attached ./strace-static-x86_64: Process 456 attached ./strace-static-x86_64: Process 455 attached ./strace-static-x86_64: Process 454 attached [pid 453] <... memfd_create resumed>) = 3 [pid 456] set_robust_list(0x555556c9c5e0, 24 [pid 454] set_robust_list(0x555556c9c5e0, 24 [pid 456] <... set_robust_list resumed>) = 0 [pid 454] <... set_robust_list resumed>) = 0 [pid 455] set_robust_list(0x7f35deafd9e0, 24 [pid 457] set_robust_list(0x555556c9c5e0, 24 [pid 453] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 456] chdir("./7") = 0 [pid 455] <... set_robust_list resumed>) = 0 [pid 454] chdir("./6" [pid 453] <... mmap resumed>) = 0x7f35d66dd000 [pid 456] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 454] <... chdir resumed>) = 0 [pid 455] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 456] <... prctl resumed>) = 0 [pid 456] setpgid(0, 0 [pid 454] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 455] <... open resumed>) = 4 [pid 456] <... setpgid resumed>) = 0 [pid 456] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 455] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 454] <... prctl resumed>) = 0 [pid 456] <... openat resumed>) = 3 [pid 454] setpgid(0, 0 [pid 455] <... futex resumed>) = 1 [pid 452] <... futex resumed>) = 0 [pid 452] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 454] <... setpgid resumed>) = 0 [pid 454] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 455] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 457] <... set_robust_list resumed>) = 0 [pid 456] write(3, "1000", 4 [pid 454] <... openat resumed>) = 3 [pid 456] <... write resumed>) = 4 [pid 454] write(3, "1000", 4 [pid 456] close(3 [pid 454] <... write resumed>) = 4 [pid 456] <... close resumed>) = 0 [pid 455] <... mount resumed>) = 0 [pid 456] symlink("/dev/binderfs", "./binderfs" [ 24.698710][ T448] loop2: detected capacity change from 0 to 512 [ 24.703952][ T442] EXT4-fs (loop5): 1 orphan inode deleted [ 24.710573][ T442] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 24.733581][ T442] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/5/file1 supports timestamps until 2038 (0x7fffffff) [ 24.734951][ T448] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [pid 454] close(3 [pid 457] chdir("./5" [pid 456] <... symlink resumed>) = 0 [pid 455] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 455] <... futex resumed>) = 1 [pid 454] <... close resumed>) = 0 [pid 452] <... futex resumed>) = 0 [pid 456] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 452] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] <... mmap resumed>) = 0x7f35deafe000 [pid 455] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 454] symlink("/dev/binderfs", "./binderfs" [pid 452] <... futex resumed>) = 0 [pid 457] <... chdir resumed>) = 0 [pid 456] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 455] <... open resumed>) = 5 [pid 454] <... symlink resumed>) = 0 [pid 452] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... mprotect resumed>) = 0 [pid 455] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 454] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 456] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 455] <... futex resumed>) = 1 [pid 452] <... futex resumed>) = 0 [pid 454] <... futex resumed>) = 0 [pid 457] <... prctl resumed>) = 0 [pid 455] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 454] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 452] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] <... clone resumed>, parent_tid=[458], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 458 [pid 455] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 454] <... mmap resumed>) = 0x7f35deafe000 [pid 452] <... futex resumed>) = 0 [pid 457] setpgid(0, 0 [pid 456] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 454] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 452] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... futex resumed>) = 0 [pid 455] <... futex resumed>) = 0 [pid 454] <... mprotect resumed>) = 0 [pid 452] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 457] <... setpgid resumed>) = 0 [pid 456] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 454] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 456] <... futex resumed>) = 0 [pid 456] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 454] <... clone resumed>, parent_tid=[459], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 459 [pid 457] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 454] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 454] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 456] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 454] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 457] <... openat resumed>) = 3 [pid 456] <... mprotect resumed>) = 0 [pid 454] <... mmap resumed>) = 0x7f35deadd000 [pid 457] write(3, "1000", 4 [pid 456] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 454] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 457] <... write resumed>) = 4 ./strace-static-x86_64: Process 459 attached [pid 456] <... clone resumed>, parent_tid=[460], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 460 [pid 454] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 457] close(3) = 0 [pid 454] <... clone resumed>, parent_tid=[461], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 461 [pid 457] symlink("/dev/binderfs", "./binderfs" [pid 454] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 454] <... futex resumed>) = 0 [pid 457] <... symlink resumed>) = 0 [pid 454] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] <... futex resumed>) = 0 [pid 456] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 459] memfd_create("syzkaller", 0 [pid 457] <... futex resumed>) = 0 [pid 459] <... memfd_create resumed>) = 3 [pid 459] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 457] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 457] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 453] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 457] <... mprotect resumed>) = 0 [pid 457] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 462 attached ./strace-static-x86_64: Process 461 attached ./strace-static-x86_64: Process 460 attached ./strace-static-x86_64: Process 458 attached [pid 453] <... write resumed>) = 262144 [pid 457] <... clone resumed>, parent_tid=[462], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 462 [pid 457] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 457] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 457] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 457] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 457] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 459] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 457] <... clone resumed>, parent_tid=[463], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 463 [pid 457] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 457] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 453] munmap(0x7f35d66dd000, 262144 [pid 461] set_robust_list(0x7f35deafd9e0, 24 [pid 453] <... munmap resumed>) = 0 [pid 453] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 6 [pid 453] ioctl(6, LOOP_SET_FD, 3./strace-static-x86_64: Process 463 attached [pid 462] set_robust_list(0x7f35deb1e9e0, 24 [pid 461] <... set_robust_list resumed>) = 0 [pid 460] set_robust_list(0x7f35deafd9e0, 24 [pid 459] <... write resumed>) = 262144 [pid 458] set_robust_list(0x7f35deb1e9e0, 24 [pid 459] munmap(0x7f35d66dd000, 262144) = 0 [pid 459] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 459] ioctl(4, LOOP_SET_FD, 3 [pid 300] <... umount2 resumed>) = 0 [pid 300] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 300] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] close(4) = 0 [pid 300] rmdir("./5/file1") = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] close(3) = 0 [pid 300] rmdir("./5") = 0 [pid 300] mkdir("./6", 0777) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 300] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 300] close(3) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 464 [pid 461] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000./strace-static-x86_64: Process 464 attached [pid 463] set_robust_list(0x7f35deafd9e0, 24 [pid 462] <... set_robust_list resumed>) = 0 [pid 460] <... set_robust_list resumed>) = 0 [pid 459] <... ioctl resumed>) = 0 [pid 458] <... set_robust_list resumed>) = 0 [pid 453] <... ioctl resumed>) = 0 [pid 448] +++ exited with 0 +++ [pid 439] +++ exited with 0 +++ [pid 463] <... set_robust_list resumed>) = 0 [pid 462] memfd_create("syzkaller", 0 [pid 460] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 459] close(3 [pid 458] memfd_create("syzkaller", 0 [pid 453] close(3 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=439, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 464] set_robust_list(0x555556c9c5e0, 24 [pid 463] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 462] <... memfd_create resumed>) = 3 [pid 460] <... open resumed>) = 3 [pid 459] <... close resumed>) = 0 [pid 458] <... memfd_create resumed>) = 4 [pid 453] <... close resumed>) = 0 [pid 464] <... set_robust_list resumed>) = 0 [pid 463] <... open resumed>) = 4 [pid 462] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 460] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] mkdir("./file1", 0777 [pid 458] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 453] mkdir("./file1", 0777 [pid 464] chdir("./6" [pid 463] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] <... mmap resumed>) = 0x7f35d66dd000 [pid 461] <... open resumed>) = 5 [pid 460] <... futex resumed>) = 1 [pid 459] <... mkdir resumed>) = 0 [pid 458] <... mmap resumed>) = 0x7f35d66dd000 [pid 456] <... futex resumed>) = 0 [pid 453] <... mkdir resumed>) = 0 [pid 297] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 464] <... chdir resumed>) = 0 [pid 463] <... futex resumed>) = 1 [pid 462] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 461] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 460] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 459] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 458] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 457] <... futex resumed>) = 0 [pid 456] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 464] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 463] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 462] <... write resumed>) = 262144 [pid 461] <... futex resumed>) = 1 [pid 460] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 457] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 454] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 461] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 457] <... futex resumed>) = 0 [pid 454] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 461] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 457] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 454] <... futex resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 461] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 454] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] fstat(3, [pid 461] <... mount resumed>) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 461] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] getdents64(3, [pid 461] <... futex resumed>) = 1 [pid 454] <... futex resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 461] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 454] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [ 24.793647][ T453] loop3: detected capacity change from 0 to 512 [ 24.795872][ T459] loop0: detected capacity change from 0 to 512 [ 24.825829][ T459] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 24.825829][ T459] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 24.825829][ T459] [pid 297] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 464] <... prctl resumed>) = 0 [pid 463] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 462] munmap(0x7f35d66dd000, 262144 [pid 461] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 460] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 458] <... write resumed>) = 262144 [pid 456] <... futex resumed>) = 0 [pid 454] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 464] setpgid(0, 0 [pid 463] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 462] <... munmap resumed>) = 0 [pid 460] <... mount resumed>) = 0 [pid 458] munmap(0x7f35d66dd000, 262144 [pid 456] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 464] <... setpgid resumed>) = 0 [pid 463] <... mount resumed>) = 0 [pid 462] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 460] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... munmap resumed>) = 0 [pid 456] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 464] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 463] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] <... openat resumed>) = 5 [pid 460] <... futex resumed>) = 0 [pid 458] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 456] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... openat resumed>) = 3 [pid 463] <... futex resumed>) = 1 [pid 462] ioctl(5, LOOP_SET_FD, 3 [pid 460] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 458] <... openat resumed>) = 5 [pid 456] <... futex resumed>) = 0 [pid 464] write(3, "1000", 4 [pid 463] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 461] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 460] <... open resumed>) = 6 [pid 458] ioctl(5, LOOP_SET_FD, 4 [pid 457] <... futex resumed>) = 0 [pid 456] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 454] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 464] <... write resumed>) = 4 [pid 461] <... open resumed>) = 3 [pid 460] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 464] close(3 [pid 463] <... futex resumed>) = 0 [pid 461] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 460] <... futex resumed>) = 0 [pid 457] <... futex resumed>) = 1 [pid 456] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] lstat("./4/bus", [pid 464] <... close resumed>) = 0 [pid 463] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 461] <... futex resumed>) = 1 [pid 460] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 457] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... futex resumed>) = 0 [pid 454] <... futex resumed>) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 464] symlink("/dev/binderfs", "./binderfs" [pid 463] <... open resumed>) = 6 [pid 461] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 460] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 456] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 454] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... symlink resumed>) = 0 [pid 463] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 460] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... ioctl resumed>) = 0 [pid 456] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 464] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 463] <... futex resumed>) = 1 [pid 460] <... futex resumed>) = 0 [pid 458] close(4 [pid 464] <... futex resumed>) = 0 [pid 463] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 460] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 458] <... close resumed>) = 0 [pid 464] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 458] mkdir("./file1", 0777 [pid 464] <... mmap resumed>) = 0x7f35deafe000 [pid 464] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 461] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 458] <... mkdir resumed>) = 0 [pid 457] <... futex resumed>) = 0 [pid 454] <... futex resumed>) = 0 [pid 297] unlink("./4/bus" [pid 464] <... mprotect resumed>) = 0 [pid 461] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 458] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 457] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 454] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 464] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 463] <... futex resumed>) = 0 [pid 462] <... ioctl resumed>) = 0 [pid 457] <... futex resumed>) = 1 [pid 297] <... unlink resumed>) = 0 [pid 462] close(3 [pid 457] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 462] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 462] mkdir("./file1", 0777 [pid 297] lstat("./4/binderfs", [pid 462] <... mkdir resumed>) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 24.845402][ T453] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 24.845402][ T453] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 24.845402][ T453] [ 24.849436][ T462] loop1: detected capacity change from 0 to 512 [ 24.873949][ T458] loop4: detected capacity change from 0 to 512 [ 24.884654][ T458] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [pid 462] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 297] unlink("./4/binderfs"./strace-static-x86_64: Process 466 attached [pid 463] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 461] <... write resumed>) = 262144 [pid 297] <... unlink resumed>) = 0 [pid 461] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 461] <... futex resumed>) = 1 [pid 454] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 461] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] lstat("./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, [pid 466] set_robust_list(0x7f35deb1e9e0, 24 [pid 464] <... clone resumed>, parent_tid=[466], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 466 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 457] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 297] rmdir("./4/file1") = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 466] <... set_robust_list resumed>) = 0 [pid 464] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] close(3 [pid 463] <... write resumed>) = 262144 [pid 297] <... close resumed>) = 0 [pid 463] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] rmdir("./4" [pid 463] <... futex resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 463] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] mkdir("./5", 0777) = 0 [ 24.884654][ T458] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 24.884654][ T458] [ 24.906185][ T459] EXT4-fs error (device loop0): __ext4_get_inode_loc:4350: comm syz-executor252: Invalid inode table block 0 in block_group 0 [ 24.906381][ T465] EXT4-fs warning (device loop0): kmmpd:170: kmmpd being stopped since MMP feature has been disabled. [ 24.920009][ T459] EXT4-fs (loop0): get root inode failed [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 466] memfd_create("syzkaller", 0 [pid 464] <... futex resumed>) = 0 [pid 459] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 297] <... close resumed>) = 0 [pid 466] <... memfd_create resumed>) = 3 [pid 464] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] ioctl(4, LOOP_CLR_FD [pid 466] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 464] <... futex resumed>) = 0 [pid 459] <... ioctl resumed>) = 0 [pid 466] <... mmap resumed>) = 0x7f35d66fe000 [pid 464] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 459] close(4 [pid 466] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 464] <... mmap resumed>) = 0x7f35d66dd000 [pid 459] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 466] <... write resumed>) = 262144 [pid 464] mprotect(0x7f35d66de000, 131072, PROT_READ|PROT_WRITE [pid 459] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 466] munmap(0x7f35d66fe000, 262144 [pid 464] <... mprotect resumed>) = 0 [pid 459] <... futex resumed>) = 0 [pid 466] <... munmap resumed>) = 0 [pid 464] clone(child_stack=0x7f35d66fd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 459] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 466] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 464] <... clone resumed>, parent_tid=[471], tls=0x7f35d66fd700, child_tidptr=0x7f35d66fd9d0) = 471 [pid 466] ioctl(4, LOOP_SET_FD, 3 [pid 464] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 472 attached ./strace-static-x86_64: Process 471 attached [pid 462] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 472] set_robust_list(0x555556c9c5e0, 24 [pid 466] <... ioctl resumed>) = 0 [pid 464] <... futex resumed>) = 0 [pid 466] close(3 [pid 464] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 466] <... close resumed>) = 0 [pid 454] exit_group(0 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 472 [pid 459] <... futex resumed>) = ? [pid 454] <... exit_group resumed>) = ? [pid 461] <... futex resumed>) = ? [pid 466] mkdir("./file1", 0777) = 0 [pid 461] +++ exited with 0 +++ [pid 466] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 471] set_robust_list(0x7f35d66fd9e0, 24) = 0 [pid 471] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 471] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 464] <... futex resumed>) = 0 [pid 471] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 464] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... mount resumed>) = 0 [pid 464] <... futex resumed>) = 0 [pid 471] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] <... futex resumed>) = 0 [pid 464] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 472] <... set_robust_list resumed>) = 0 [pid 471] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 464] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] ioctl(5, LOOP_CLR_FD [pid 472] chdir("./5" [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 464] <... futex resumed>) = 0 [pid 462] <... ioctl resumed>) = 0 [pid 472] <... chdir resumed>) = 0 [pid 471] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 464] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] close(5 [pid 472] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 471] <... open resumed>) = 5 [pid 462] <... close resumed>) = 0 [pid 472] <... prctl resumed>) = 0 [pid 471] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 472] setpgid(0, 0 [pid 471] <... futex resumed>) = 1 [pid 464] <... futex resumed>) = 0 [ 24.942254][ T459] EXT4-fs (loop0): mount failed [ 24.950428][ T462] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 24.953691][ T466] loop5: detected capacity change from 0 to 512 [ 24.966567][ T466] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 24.966567][ T466] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 24.966567][ T466] [ 24.967581][ T453] EXT4-fs (loop3): 1 orphan inode deleted [ 24.990480][ T458] EXT4-fs (loop4): 1 orphan inode deleted [pid 462] <... futex resumed>) = 0 [pid 457] exit_group(0 [pid 472] <... setpgid resumed>) = 0 [pid 471] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 464] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 472] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 464] <... futex resumed>) = 0 [pid 472] <... openat resumed>) = 3 [pid 471] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 464] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 472] write(3, "1000", 4) = 4 [pid 472] close(3) = 0 [pid 472] symlink("/dev/binderfs", "./binderfs") = 0 [pid 472] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 472] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 472] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 472] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[474], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 474 [pid 472] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 472] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 472] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 472] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 472] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[475], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 475 [pid 472] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 472] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] <... write resumed>) = 262144 [pid 463] <... futex resumed>) = ? [pid 462] <... futex resumed>) = ? [pid 459] +++ exited with 0 +++ [pid 457] <... exit_group resumed>) = ? [pid 454] +++ exited with 0 +++ [ 24.996231][ T458] EXT4-fs (loop4): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 25.008930][ T453] EXT4-fs (loop3): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [pid 471] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 463] +++ exited with 0 +++ [pid 462] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=454, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 471] <... futex resumed>) = 1 [pid 464] <... futex resumed>) = 0 [pid 471] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 472] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 472] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] <... mount resumed>) = 0 [pid 472] <... futex resumed>) = 0 [pid 453] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 295] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 475 attached ./strace-static-x86_64: Process 474 attached [pid 472] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 466] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 453] <... openat resumed>) = 3 [pid 475] set_robust_list(0x7f35deafd9e0, 24 [pid 474] set_robust_list(0x7f35deb1e9e0, 24 [pid 458] <... mount resumed>) = 0 [pid 475] <... set_robust_list resumed>) = 0 [pid 474] <... set_robust_list resumed>) = 0 [pid 472] <... mmap resumed>) = 0x7f35deabc000 [pid 458] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 453] chdir("./file1" [pid 466] ioctl(4, LOOP_CLR_FD [pid 295] <... umount2 resumed>) = 0 [pid 475] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 474] memfd_create("syzkaller", 0 [pid 472] mprotect(0x7f35deabd000, 131072, PROT_READ|PROT_WRITE [pid 466] <... ioctl resumed>) = 0 [pid 458] <... openat resumed>) = 4 [pid 453] <... chdir resumed>) = 0 [pid 295] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 475] <... open resumed>) = 3 [pid 474] <... memfd_create resumed>) = 4 [pid 472] <... mprotect resumed>) = 0 [pid 466] close(4 [pid 458] chdir("./file1" [pid 453] ioctl(6, LOOP_CLR_FD [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 475] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 474] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 472] clone(child_stack=0x7f35deadc3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 453] <... ioctl resumed>) = 0 [pid 295] lstat("./6/bus", [pid 475] <... futex resumed>) = 0 [pid 474] <... mmap resumed>) = 0x7f35d66bc000 [pid 453] close(6 [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 475] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 474] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 472] <... clone resumed>, parent_tid=[476], tls=0x7f35deadc700, child_tidptr=0x7f35deadc9d0) = 476 [pid 466] <... close resumed>) = 0 [pid 458] <... chdir resumed>) = 0 [pid 453] <... close resumed>) = 0 [pid 295] unlink("./6/bus" [pid 474] <... write resumed>) = 262144 [pid 472] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 466] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] ioctl(5, LOOP_CLR_FD [pid 453] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... unlink resumed>) = 0 [pid 474] munmap(0x7f35d66bc000, 262144 [pid 472] <... futex resumed>) = 0 [pid 464] exit_group(0 [pid 453] <... futex resumed>) = 0 [pid 452] exit_group(0 [pid 466] <... futex resumed>) = ? [pid 458] <... ioctl resumed>) = 0 [pid 457] +++ exited with 0 +++ [pid 295] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 476 attached [pid 474] <... munmap resumed>) = 0 [pid 472] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] <... futex resumed>) = ? [pid 464] <... exit_group resumed>) = ? [pid 455] <... futex resumed>) = ? [pid 452] <... exit_group resumed>) = ? [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=457, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 476] set_robust_list(0x7f35deadc9e0, 24 [pid 474] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 471] +++ exited with 0 +++ [pid 458] close(5 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 458] <... close resumed>) = 0 [pid 458] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] +++ exited with 0 +++ [pid 474] <... openat resumed>) = 5 [pid 453] +++ exited with 0 +++ [pid 452] +++ exited with 0 +++ [pid 295] lstat("./6/binderfs", [pid 474] ioctl(5, LOOP_SET_FD, 4 [ 25.033561][ T466] EXT4-fs (loop5): Magic mismatch, very weird! [ 25.042728][ T453] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/6/file1 supports timestamps until 2038 (0x7fffffff) [ 25.059633][ T458] ext4 filesystem being mounted at /root/syzkaller.RJEgPO/7/file1 supports timestamps until 2038 (0x7fffffff) [pid 456] exit_group(0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=452, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 476] <... set_robust_list resumed>) = 0 [pid 460] <... futex resumed>) = ? [pid 458] <... futex resumed>) = ? [pid 456] <... exit_group resumed>) = ? [pid 460] +++ exited with 0 +++ [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 295] unlink("./6/binderfs" [pid 458] +++ exited with 0 +++ [pid 456] +++ exited with 0 +++ [pid 298] <... restart_syscall resumed>) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=456, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] <... unlink resumed>) = 0 [pid 295] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] lstat("./6/file1", [pid 298] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 3 [pid 296] fstat(3, [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] fstat(3, [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, [pid 299] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] getdents64(3, [pid 299] <... openat resumed>) = 3 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 476] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 474] <... ioctl resumed>) = 0 [pid 299] fstat(3, [pid 298] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... openat resumed>) = 4 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 295] fstat(4, [pid 299] getdents64(3, [pid 298] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] getdents64(4, [pid 299] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] lstat("./6/bus", [pid 296] lstat("./5/bus", [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] <... umount2 resumed>) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] getdents64(4, [pid 474] close(4 [pid 299] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] unlink("./6/bus" [pid 296] unlink("./5/bus" [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 476] <... mount resumed>) = 0 [pid 474] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... unlink resumed>) = 0 [pid 299] lstat("./7/bus", [pid 298] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... unlink resumed>) = 0 [pid 295] close(4 [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] unlink("./7/bus" [pid 298] lstat("./6/binderfs", [pid 296] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... close resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] unlink("./6/binderfs" [pid 295] rmdir("./6/file1" [pid 296] lstat("./5/binderfs", [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... unlink resumed>) = 0 [pid 476] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 472] <... futex resumed>) = 0 [pid 476] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 472] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 475] <... futex resumed>) = 0 [pid 472] <... futex resumed>) = 1 [pid 299] lstat("./7/binderfs", [pid 298] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 475] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 472] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./5/binderfs" [pid 295] getdents64(3, [pid 474] mkdir("./file1", 0777 [pid 475] <... open resumed>) = 4 [pid 474] <... mkdir resumed>) = 0 [pid 299] unlink("./7/binderfs" [pid 296] <... unlink resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 474] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 475] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] close(3 [pid 475] <... futex resumed>) = 1 [pid 472] <... futex resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... close resumed>) = 0 [pid 472] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 475] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 472] <... futex resumed>) = 0 [pid 299] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] lstat("./5/file1", [pid 295] rmdir("./6" [pid 472] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 296] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] mkdir("./7", 0777 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 296] <... openat resumed>) = 4 [pid 295] <... openat resumed>) = 3 [pid 296] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 296] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] getdents64(4, [pid 295] close(3 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] close(4 [pid 295] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] rmdir("./5/file1"./strace-static-x86_64: Process 477 attached ) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 477 [pid 296] getdents64(3, [pid 477] set_robust_list(0x555556c9c5e0, 24 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 477] <... set_robust_list resumed>) = 0 [pid 296] close(3 [pid 477] chdir("./7" [pid 296] <... close resumed>) = 0 [pid 477] <... chdir resumed>) = 0 [pid 296] rmdir("./5" [pid 477] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] <... rmdir resumed>) = 0 [pid 477] <... prctl resumed>) = 0 [pid 296] mkdir("./6", 0777 [pid 477] setpgid(0, 0) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 474] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... openat resumed>) = 3 [pid 477] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 474] ioctl(5, LOOP_CLR_FD [pid 475] <... write resumed>) = 262144 [pid 296] ioctl(3, LOOP_CLR_FD [pid 477] <... openat resumed>) = 3 [pid 477] write(3, "1000", 4 [pid 475] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 474] <... ioctl resumed>) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 477] <... write resumed>) = 4 [pid 296] close(3 [pid 477] close(3 [pid 296] <... close resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 477] <... close resumed>) = 0 [pid 477] symlink("/dev/binderfs", "./binderfs") = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 478 [pid 477] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 477] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 477] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 ./strace-static-x86_64: Process 478 attached [pid 475] <... futex resumed>) = 1 [pid 474] close(5 [pid 472] <... futex resumed>) = 0 [pid 477] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 475] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 474] <... close resumed>) = 0 [pid 474] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 474] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 478] set_robust_list(0x555556c9c5e0, 24) = 0 ./strace-static-x86_64: Process 479 attached [pid 478] chdir("./6") = 0 [pid 478] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 478] setpgid(0, 0) = 0 [pid 472] exit_group(0 [pid 477] <... clone resumed>, parent_tid=[479], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 479 [pid 476] <... futex resumed>) = ? [pid 475] <... futex resumed>) = ? [pid 472] <... exit_group resumed>) = ? [pid 475] +++ exited with 0 +++ [pid 476] +++ exited with 0 +++ [pid 474] <... futex resumed>) = ? [pid 477] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] set_robust_list(0x7f35deb1e9e0, 24 [pid 477] <... futex resumed>) = 0 [pid 478] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 479] <... set_robust_list resumed>) = 0 [pid 478] <... openat resumed>) = 3 [pid 477] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 477] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 477] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 477] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 479] memfd_create("syzkaller", 0 [pid 478] write(3, "1000", 4./strace-static-x86_64: Process 480 attached [pid 479] <... memfd_create resumed>) = 3 [pid 477] <... clone resumed>, parent_tid=[480], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 480 [pid 477] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 478] <... write resumed>) = 4 [pid 477] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 479] <... mmap resumed>) = 0x7f35d66dd000 [pid 478] close(3) = 0 [pid 478] symlink("/dev/binderfs", "./binderfs" [pid 480] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 480] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 478] <... symlink resumed>) = 0 [pid 480] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 477] <... futex resumed>) = 0 [pid 477] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 477] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... futex resumed>) = 1 [pid 480] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 480] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 477] <... futex resumed>) = 0 [pid 477] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 477] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... futex resumed>) = 1 [pid 480] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 478] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 480] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 478] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 480] <... futex resumed>) = 1 [pid 477] <... futex resumed>) = 0 [pid 480] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 477] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 478] <... mmap resumed>) = 0x7f35deafe000 [pid 477] <... futex resumed>) = 0 [pid 480] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 477] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... futex resumed>) = 0 [pid 477] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 480] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 478] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 479] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 478] <... mprotect resumed>) = 0 [pid 479] <... write resumed>) = 262144 [pid 479] munmap(0x7f35d66dd000, 262144 [pid 478] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 479] <... munmap resumed>) = 0 [pid 479] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 479] ioctl(6, LOOP_SET_FD, 3 [pid 466] +++ exited with 0 +++ [pid 464] +++ exited with 0 +++ [pid 299] <... umount2 resumed>) = 0 [pid 478] <... clone resumed>, parent_tid=[481], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 481 [pid 299] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 478] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 478] <... futex resumed>) = 0 [pid 299] lstat("./7/file1", [ 25.087413][ T474] loop2: detected capacity change from 0 to 512 [ 25.107869][ T474] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [pid 478] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 478] <... futex resumed>) = 0 [pid 299] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 478] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 478] <... mmap resumed>) = 0x7f35deadd000 [pid 299] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 478] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 299] <... openat resumed>) = 4 [pid 478] <... mprotect resumed>) = 0 [pid 299] fstat(4, [pid 478] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=464, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 299] getdents64(4, [pid 298] <... umount2 resumed>) = 0 [pid 478] <... clone resumed>, parent_tid=[482], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 482 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 ./strace-static-x86_64: Process 482 attached ./strace-static-x86_64: Process 481 attached [pid 479] <... ioctl resumed>) = 0 [pid 478] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 474] +++ exited with 0 +++ [pid 472] +++ exited with 0 +++ [pid 298] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] set_robust_list(0x7f35deafd9e0, 24 [pid 481] set_robust_list(0x7f35deb1e9e0, 24 [pid 479] close(3 [pid 300] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 482] <... set_robust_list resumed>) = 0 [pid 481] <... set_robust_list resumed>) = 0 [pid 479] <... close resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./6/file1", [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=472, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 482] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 481] memfd_create("syzkaller", 0 [pid 479] mkdir("./file1", 0777 [pid 300] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 482] <... open resumed>) = 3 [pid 481] <... memfd_create resumed>) = 4 [pid 479] <... mkdir resumed>) = 0 [pid 300] <... openat resumed>) = 3 [pid 298] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... restart_syscall resumed>) = 0 [pid 482] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 481] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 479] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 300] fstat(3, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 482] <... futex resumed>) = 0 [pid 481] <... mmap resumed>) = 0x7f35d66dd000 [pid 478] <... futex resumed>) = 0 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(4, [pid 298] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 482] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 481] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 478] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] getdents64(3, [pid 298] <... openat resumed>) = 4 [pid 297] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 481] <... write resumed>) = 262144 [pid 478] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] fstat(4, [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 481] munmap(0x7f35d66dd000, 262144 [pid 478] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = 0 [pid 299] close(4 [pid 298] getdents64(4, [pid 297] <... openat resumed>) = 3 [pid 481] <... munmap resumed>) = 0 [pid 300] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] fstat(3, [pid 481] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] getdents64(4, [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 481] <... openat resumed>) = 5 [pid 300] lstat("./6/bus", [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] getdents64(3, [pid 481] ioctl(5, LOOP_SET_FD, 4 [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] close(4 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 482] <... futex resumed>) = 0 [pid 478] <... futex resumed>) = 1 [pid 300] unlink("./6/bus" [pid 299] <... close resumed>) = 0 [pid 478] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] rmdir("./7/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./7") = 0 [pid 299] mkdir("./8", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 482] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 481] <... ioctl resumed>) = 0 [pid 300] <... unlink resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] <... mount resumed>) = 0 [pid 481] close(4 [pid 300] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] rmdir("./6/file1" [pid 297] <... umount2 resumed>) = 0 [pid 482] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 481] <... close resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... rmdir resumed>) = 0 [pid 297] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] <... futex resumed>) = 1 [pid 481] mkdir("./file1", 0777 [pid 300] lstat("./6/binderfs", [pid 298] getdents64(3, [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 482] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 481] <... mkdir resumed>) = 0 [pid 478] <... futex resumed>) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] lstat("./5/bus", [pid 481] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 300] unlink("./6/binderfs" [pid 298] close(3 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] <... unlink resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] unlink("./5/bus" [pid 300] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] rmdir("./6" [pid 297] <... unlink resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... rmdir resumed>) = 0 [pid 297] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 478] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 483 [pid 478] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 483 attached [pid 483] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 483] chdir("./8") = 0 [pid 483] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 483] setpgid(0, 0) = 0 [pid 483] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 483] write(3, "1000", 4) = 4 [pid 483] close(3) = 0 [pid 483] symlink("/dev/binderfs", "./binderfs") = 0 [pid 483] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 25.132841][ T479] loop0: detected capacity change from 0 to 512 [ 25.145193][ T479] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 25.145193][ T479] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.145193][ T479] [ 25.170500][ T481] loop1: detected capacity change from 0 to 512 [pid 483] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 483] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 483] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[485], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 485 [pid 483] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 483] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 483] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 483] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 483] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[486], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 486 [pid 483] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 483] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 485 attached [pid 485] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 485] memfd_create("syzkaller", 0) = 3 [pid 485] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 485] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 300] lstat("./6/file1", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 482] <... futex resumed>) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] lstat("./5/binderfs", ./strace-static-x86_64: Process 486 attached [pid 482] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 300] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] mkdir("./7", 0777 [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 486] set_robust_list(0x7f35deafd9e0, 24 [pid 482] <... open resumed>) = 4 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 486] <... set_robust_list resumed>) = 0 [pid 482] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... mkdir resumed>) = 0 [pid 297] unlink("./5/binderfs" [pid 486] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 482] <... futex resumed>) = 1 [pid 478] <... futex resumed>) = 0 [pid 300] <... openat resumed>) = 4 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 485] <... write resumed>) = 262144 [pid 297] <... unlink resumed>) = 0 [pid 486] <... open resumed>) = 4 [pid 485] munmap(0x7f35d66dd000, 262144 [pid 478] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 486] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 478] <... futex resumed>) = 0 [pid 300] fstat(4, [pid 298] <... openat resumed>) = 3 [pid 297] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 485] <... munmap resumed>) = 0 [pid 485] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 5 [pid 485] ioctl(5, LOOP_SET_FD, 3 [pid 486] <... futex resumed>) = 1 [pid 482] <... write resumed>) = 262144 [pid 478] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 483] <... futex resumed>) = 0 [pid 483] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 483] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 485] <... ioctl resumed>) = 0 [pid 485] close(3) = 0 [pid 485] mkdir("./file1", 0777) = 0 [pid 485] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 486] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 482] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 481] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 478] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] getdents64(4, [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [ 25.180096][ T481] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 25.180096][ T481] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.180096][ T481] [ 25.202331][ T485] loop4: detected capacity change from 0 to 512 [ 25.203895][ T481] EXT4-fs warning (device loop1): read_mmp_block:115: Error -117 while reading MMP block 8 [ 25.214041][ T479] EXT4-fs (loop0): 1 orphan inode deleted [ 25.218611][ T485] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [pid 297] lstat("./5/file1", [pid 486] <... mount resumed>) = 0 [pid 482] <... futex resumed>) = 0 [pid 481] ioctl(5, LOOP_CLR_FD [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] close(3 [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 486] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 481] <... ioctl resumed>) = 0 [pid 300] getdents64(4, [pid 298] <... close resumed>) = 0 [pid 297] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 486] <... futex resumed>) = 1 [pid 481] close(5 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 486] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 481] <... close resumed>) = 0 [pid 300] close(4./strace-static-x86_64: Process 488 attached [pid 483] <... futex resumed>) = 0 [pid 481] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... close resumed>) = 0 [pid 297] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 483] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 483] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 488] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 488] chdir("./7") = 0 [pid 488] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 488] setpgid(0, 0) = 0 [pid 488] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 488] write(3, "1000", 4) = 4 [pid 488] close(3) = 0 [pid 488] symlink("/dev/binderfs", "./binderfs") = 0 [pid 488] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 488] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 488] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 486] <... futex resumed>) = 0 [pid 481] <... futex resumed>) = 0 [pid 479] <... mount resumed>) = 0 [pid 300] rmdir("./6/file1" [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 488 [pid 297] <... openat resumed>) = 4 [pid 486] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 481] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 478] exit_group(0./strace-static-x86_64: Process 489 attached [pid 486] <... open resumed>) = 3 [pid 482] <... futex resumed>) = ? [pid 481] <... futex resumed>) = ? [pid 479] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 478] <... exit_group resumed>) = ? [pid 300] <... rmdir resumed>) = 0 [pid 297] fstat(4, [pid 489] set_robust_list(0x7f35deb1e9e0, 24 [pid 488] <... clone resumed>, parent_tid=[489], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 489 [pid 486] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] +++ exited with 0 +++ [pid 481] +++ exited with 0 +++ [pid 479] <... openat resumed>) = 3 [pid 300] getdents64(3, [pid 488] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 486] <... futex resumed>) = 1 [pid 483] <... futex resumed>) = 0 [pid 489] <... set_robust_list resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 486] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 483] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] close(3 [pid 486] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 483] <... futex resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 486] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 483] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] rmdir("./6" [pid 489] memfd_create("syzkaller", 0 [pid 488] <... futex resumed>) = 0 [pid 479] chdir("./file1" [pid 297] getdents64(4, [pid 489] <... memfd_create resumed>) = 3 [pid 488] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... rmdir resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 489] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 488] <... futex resumed>) = 0 [pid 297] getdents64(4, [pid 489] <... mmap resumed>) = 0x7f35d66fe000 [pid 488] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 489] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 488] <... mmap resumed>) = 0x7f35d66dd000 [pid 297] close(4 [pid 489] <... write resumed>) = 262144 [pid 488] mprotect(0x7f35d66de000, 131072, PROT_READ|PROT_WRITE [pid 297] <... close resumed>) = 0 [ 25.218611][ T485] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.218611][ T485] [ 25.224624][ T479] EXT4-fs (loop0): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 25.265905][ T479] ext4 filesystem being mounted at /root/syzkaller.d28Auw/7/file1 supports timestamps until 2038 (0x7fffffff) [pid 489] munmap(0x7f35d66fe000, 262144 [pid 488] <... mprotect resumed>) = 0 [pid 297] rmdir("./5/file1" [pid 489] <... munmap resumed>) = 0 [pid 488] clone(child_stack=0x7f35d66fd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] <... rmdir resumed>) = 0 [pid 489] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 297] getdents64(3, [pid 489] <... openat resumed>) = 4 [pid 488] <... clone resumed>, parent_tid=[493], tls=0x7f35d66fd700, child_tidptr=0x7f35d66fd9d0) = 493 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 489] ioctl(4, LOOP_SET_FD, 3 [pid 488] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] close(3./strace-static-x86_64: Process 493 attached [pid 488] <... futex resumed>) = 0 [pid 486] <... write resumed>) = 262144 [pid 300] mkdir("./7", 0777 [pid 297] <... close resumed>) = 0 [pid 488] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] rmdir("./5") = 0 [pid 297] mkdir("./6", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 494 [pid 479] <... chdir resumed>) = 0 [pid 479] ioctl(6, LOOP_CLR_FD) = 0 [pid 479] close(6) = 0 [pid 493] set_robust_list(0x7f35d66fd9e0, 24 [pid 486] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 493] <... set_robust_list resumed>) = 0 [pid 300] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 494 attached [pid 493] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 486] <... futex resumed>) = 1 [pid 483] <... futex resumed>) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 479] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 477] exit_group(0 [pid 480] <... futex resumed>) = ? [pid 477] <... exit_group resumed>) = ? [pid 480] +++ exited with 0 +++ [pid 479] +++ exited with 0 +++ [pid 477] +++ exited with 0 +++ [pid 489] <... ioctl resumed>) = 0 [pid 489] close(3) = 0 [pid 489] mkdir("./file1", 0777) = 0 [pid 489] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=477, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 493] <... open resumed>) = 3 [pid 486] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 493] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... openat resumed>) = 3 [pid 493] <... futex resumed>) = 1 [pid 488] <... futex resumed>) = 0 [pid 300] ioctl(3, LOOP_CLR_FD [pid 494] set_robust_list(0x555556c9c5e0, 24 [pid 493] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] close(3) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 495 [pid 494] <... set_robust_list resumed>) = 0 [pid 494] chdir("./6") = 0 [pid 494] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 494] setpgid(0, 0) = 0 [pid 494] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 494] write(3, "1000", 4) = 4 [pid 494] close(3) = 0 [pid 494] symlink("/dev/binderfs", "./binderfs") = 0 [pid 494] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 494] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 494] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 494] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[496], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 496 [pid 494] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 494] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 494] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 494] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 494] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[497], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 497 [pid 494] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 494] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 493] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 493] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 493] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 488] <... futex resumed>) = 0 [pid 493] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 493] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 488] <... futex resumed>) = 0 [pid 493] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 488] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 493] <... open resumed>) = 5 [pid 493] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 488] <... futex resumed>) = 0 [pid 493] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 493] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 488] <... futex resumed>) = 0 [pid 493] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 488] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 497 attached ./strace-static-x86_64: Process 496 attached ./strace-static-x86_64: Process 495 attached [pid 485] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 497] set_robust_list(0x7f35deafd9e0, 24 [pid 496] set_robust_list(0x7f35deb1e9e0, 24 [pid 495] set_robust_list(0x555556c9c5e0, 24 [pid 493] <... write resumed>) = 262144 [pid 485] ioctl(5, LOOP_CLR_FD [pid 497] <... set_robust_list resumed>) = 0 [pid 496] <... set_robust_list resumed>) = 0 [pid 495] <... set_robust_list resumed>) = 0 [pid 493] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] <... ioctl resumed>) = 0 [pid 497] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 496] memfd_create("syzkaller", 0 [pid 495] chdir("./7" [pid 493] <... futex resumed>) = 1 [pid 488] <... futex resumed>) = 0 [pid 485] close(5 [pid 497] <... open resumed>) = 3 [pid 496] <... memfd_create resumed>) = 4 [pid 495] <... chdir resumed>) = 0 [pid 493] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 485] <... close resumed>) = 0 [pid 295] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 497] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 495] prctl(PR_SET_PDEATHSIG, SIGKILL [ 25.283311][ T485] EXT4-fs error (device loop4): __ext4_get_inode_loc:4350: comm syz-executor252: Invalid inode table block 0 in block_group 0 [ 25.291758][ T489] loop3: detected capacity change from 0 to 512 [ 25.299000][ T485] EXT4-fs (loop4): get root inode failed [ 25.308455][ T485] EXT4-fs (loop4): mount failed [ 25.313688][ T489] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 25.313688][ T489] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.313688][ T489] [pid 485] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 497] <... futex resumed>) = 1 [pid 496] <... mmap resumed>) = 0x7f35d66dd000 [pid 495] <... prctl resumed>) = 0 [pid 489] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 485] <... futex resumed>) = 0 [pid 483] exit_group(0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 497] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 496] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 495] setpgid(0, 0 [pid 494] <... futex resumed>) = 0 [pid 478] +++ exited with 0 +++ [pid 496] <... write resumed>) = 262144 [pid 494] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 497] <... futex resumed>) = 0 [pid 496] munmap(0x7f35d66dd000, 262144 [pid 494] <... futex resumed>) = 1 [pid 497] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 496] <... munmap resumed>) = 0 [pid 494] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 497] <... mount resumed>) = 0 [pid 496] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 497] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] <... openat resumed>) = 5 [pid 486] <... futex resumed>) = ? [pid 483] <... exit_group resumed>) = ? [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=478, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 497] <... futex resumed>) = 1 [pid 496] ioctl(5, LOOP_SET_FD, 4 [pid 495] <... setpgid resumed>) = 0 [pid 494] <... futex resumed>) = 0 [pid 486] +++ exited with 0 +++ [pid 497] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 496] <... ioctl resumed>) = 0 [pid 494] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... openat resumed>) = 3 [pid 497] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 497] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 494] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 497] <... open resumed>) = 6 [pid 497] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] <... futex resumed>) = 0 [pid 497] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 497] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 497] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 494] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 497] <... write resumed>) = 262144 [pid 495] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 489] ioctl(4, LOOP_CLR_FD [pid 295] fstat(3, [pid 497] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] <... futex resumed>) = 0 [pid 497] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 496] close(4) = 0 [pid 496] mkdir("./file1", 0777) = 0 [pid 496] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 495] <... openat resumed>) = 3 [pid 296] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 495] write(3, "1000", 4 [pid 489] <... ioctl resumed>) = 0 [pid 495] <... write resumed>) = 4 [pid 489] close(4 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] getdents64(3, [pid 495] close(3 [pid 489] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 495] <... close resumed>) = 0 [pid 489] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] exit_group(0 [pid 296] <... openat resumed>) = 3 [pid 295] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 495] symlink("/dev/binderfs", "./binderfs" [pid 493] <... futex resumed>) = ? [pid 489] <... futex resumed>) = ? [pid 488] <... exit_group resumed>) = ? [pid 296] fstat(3, [pid 496] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 495] <... symlink resumed>) = 0 [pid 493] +++ exited with 0 +++ [pid 489] +++ exited with 0 +++ [pid 295] <... umount2 resumed>) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 495] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] getdents64(3, [pid 495] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 496] ioctl(5, LOOP_CLR_FD [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] lstat("./7/bus", [pid 495] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 495] <... mmap resumed>) = 0x7f35deafe000 [pid 496] <... ioctl resumed>) = 0 [pid 295] unlink("./7/bus" [pid 296] <... umount2 resumed>) = 0 [pid 496] close(5) = 0 [pid 496] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 295] <... unlink resumed>) = 0 [pid 296] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 495] <... mprotect resumed>) = 0 [pid 295] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 496] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 495] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] lstat("./6/bus", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 494] exit_group(0 [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 497] <... futex resumed>) = ? [pid 496] <... futex resumed>) = ? [pid 495] <... clone resumed>, parent_tid=[498], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 498 [pid 494] <... exit_group resumed>) = ? [pid 296] unlink("./6/bus" [pid 295] lstat("./7/binderfs", ./strace-static-x86_64: Process 498 attached [pid 497] +++ exited with 0 +++ [pid 495] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... unlink resumed>) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 498] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 498] memfd_create("syzkaller", 0) = 3 [pid 498] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66fe000 [pid 495] <... futex resumed>) = 0 [pid 296] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] unlink("./7/binderfs" [pid 495] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... unlink resumed>) = 0 [pid 498] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 495] <... futex resumed>) = 0 [pid 296] lstat("./6/binderfs", [pid 295] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 498] <... write resumed>) = 262144 [pid 495] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 498] munmap(0x7f35d66fe000, 262144 [pid 495] <... mmap resumed>) = 0x7f35d66dd000 [pid 296] unlink("./6/binderfs" [pid 498] <... munmap resumed>) = 0 [pid 498] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 498] ioctl(4, LOOP_SET_FD, 3 [pid 495] mprotect(0x7f35d66de000, 131072, PROT_READ|PROT_WRITE [pid 296] <... unlink resumed>) = 0 [pid 495] <... mprotect resumed>) = 0 [pid 296] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 495] clone(child_stack=0x7f35d66fd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./6/file1", [pid 495] <... clone resumed>, parent_tid=[499], tls=0x7f35d66fd700, child_tidptr=0x7f35d66fd9d0) = 499 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 495] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 495] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 499 attached [pid 498] <... ioctl resumed>) = 0 [pid 495] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 499] set_robust_list(0x7f35d66fd9e0, 24 [pid 498] close(3 [pid 499] <... set_robust_list resumed>) = 0 [pid 498] <... close resumed>) = 0 [pid 296] <... openat resumed>) = 4 [pid 499] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 498] mkdir("./file1", 0777 [pid 499] <... open resumed>) = 3 [pid 498] <... mkdir resumed>) = 0 [pid 296] fstat(4, [pid 499] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 498] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 499] <... futex resumed>) = 1 [pid 495] <... futex resumed>) = 0 [pid 499] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 495] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] getdents64(4, [pid 495] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 495] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./6/file1") = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [ 25.335380][ T489] EXT4-fs (loop3): Magic mismatch, very weird! [ 25.346677][ T496] loop2: detected capacity change from 0 to 512 [ 25.359702][ T496] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [ 25.373556][ T498] loop5: detected capacity change from 0 to 512 [pid 296] rmdir("./6" [pid 488] +++ exited with 0 +++ [pid 485] +++ exited with 0 +++ [pid 483] +++ exited with 0 +++ [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./7", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 500 [pid 499] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 499] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 499] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 495] <... futex resumed>) = 0 [pid 499] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 495] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 495] <... futex resumed>) = 0 [pid 499] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 495] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 499] <... open resumed>) = 5 [pid 499] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 495] <... futex resumed>) = 0 [pid 499] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 495] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 499] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 495] <... futex resumed>) = 0 [pid 499] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 495] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 500 attached [pid 500] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=483, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=488, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 500] chdir("./7") = 0 [pid 500] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 500] setpgid(0, 0) = 0 [pid 500] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 496] +++ exited with 0 +++ [pid 494] +++ exited with 0 +++ [pid 299] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 500] write(3, "1000", 4) = 4 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=494, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 500] close(3 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 500] <... close resumed>) = 0 [pid 500] symlink("/dev/binderfs", "./binderfs") = 0 [pid 500] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 500] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 500] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[501], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 501 [pid 500] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 500] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 500] <... mmap resumed>) = 0x7f35deadd000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 500] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 297] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 500] <... mprotect resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 500] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 500] <... clone resumed>, parent_tid=[502], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 502 [pid 297] getdents64(3, [pid 500] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 500] <... futex resumed>) = 0 [pid 297] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 500] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 297] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./6/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] unlink("./6/bus" [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... unlink resumed>) = 0 [pid 297] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./6/binderfs") = 0 [pid 297] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./6/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] fstat(4, [pid 499] <... write resumed>) = 262144 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 499] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] getdents64(4, [pid 499] <... futex resumed>) = 1 [pid 495] <... futex resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 499] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./6/file1") = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./6") = 0 [pid 297] mkdir("./7", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 503 ./strace-static-x86_64: Process 503 attached [pid 503] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 503] chdir("./7") = 0 [pid 503] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 503] setpgid(0, 0) = 0 [pid 503] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 503] write(3, "1000", 4) = 4 [pid 503] close(3) = 0 [pid 503] symlink("/dev/binderfs", "./binderfs") = 0 [pid 503] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 503] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 503] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[504], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 504 [pid 503] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 503] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 503] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[505], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 505 [pid 503] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 504 attached [pid 504] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 504] memfd_create("syzkaller", 0) = 3 [pid 504] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 504] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 504] munmap(0x7f35d66dd000, 262144) = 0 [pid 504] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 504] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 505 attached ./strace-static-x86_64: Process 502 attached ./strace-static-x86_64: Process 501 attached [pid 498] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = 0 [pid 505] set_robust_list(0x7f35deafd9e0, 24 [pid 502] set_robust_list(0x7f35deafd9e0, 24 [pid 501] set_robust_list(0x7f35deb1e9e0, 24 [pid 498] ioctl(4, LOOP_CLR_FD [pid 299] <... openat resumed>) = 3 [pid 298] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 504] <... ioctl resumed>) = 0 [pid 504] close(3) = 0 [pid 504] mkdir("./file1", 0777 [pid 502] <... set_robust_list resumed>) = 0 [pid 501] <... set_robust_list resumed>) = 0 [pid 299] fstat(3, [pid 298] <... openat resumed>) = 3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 505] <... set_robust_list resumed>) = 0 [pid 502] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 501] memfd_create("syzkaller", 0 [pid 498] <... ioctl resumed>) = 0 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] fstat(3, [pid 295] lstat("./7/file1", [pid 502] <... open resumed>) = 3 [pid 299] getdents64(3, [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 502] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 501] <... memfd_create resumed>) = 4 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 505] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 502] <... futex resumed>) = 1 [pid 501] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 498] close(4 [pid 299] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(3, [pid 295] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 500] <... futex resumed>) = 0 [pid 500] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 501] <... mmap resumed>) = 0x7f35d66dd000 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 502] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 500] <... futex resumed>) = 0 [pid 498] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 500] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 502] <... mount resumed>) = 0 [pid 501] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 498] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... openat resumed>) = 4 [pid 502] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 498] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] fstat(4, [pid 495] exit_group(0 [pid 499] <... futex resumed>) = ? [pid 495] <... exit_group resumed>) = ? [pid 499] +++ exited with 0 +++ [pid 502] <... futex resumed>) = 1 [pid 501] <... write resumed>) = 262144 [pid 500] <... futex resumed>) = 0 [pid 299] lstat("./8/bus", [pid 298] <... umount2 resumed>) = 0 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 500] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 502] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 500] <... futex resumed>) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(4, [pid 500] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 505] <... open resumed>) = 3 [pid 504] <... mkdir resumed>) = 0 [pid 502] <... open resumed>) = 5 [pid 501] munmap(0x7f35d66dd000, 262144 [pid 299] unlink("./8/bus" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] lstat("./7/bus", [pid 295] getdents64(4, [pid 299] <... unlink resumed>) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 502] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 505] <... futex resumed>) = 1 [pid 503] <... futex resumed>) = 0 [pid 502] <... futex resumed>) = 1 [pid 500] <... futex resumed>) = 0 [pid 299] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] unlink("./7/bus" [pid 295] close(4 [pid 505] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 503] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 502] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 500] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 503] <... futex resumed>) = 0 [pid 500] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 503] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 502] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 500] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] lstat("./8/binderfs", [pid 295] <... close resumed>) = 0 [pid 505] <... mount resumed>) = 0 [pid 502] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] rmdir("./7/file1" [pid 501] <... munmap resumed>) = 0 [pid 505] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 502] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 299] unlink("./8/binderfs" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... rmdir resumed>) = 0 [pid 502] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... futex resumed>) = 1 [pid 504] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 503] <... futex resumed>) = 0 [pid 502] <... futex resumed>) = 1 [pid 501] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 500] <... futex resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 298] lstat("./7/binderfs", [pid 295] getdents64(3, [pid 505] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 503] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 502] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 501] <... openat resumed>) = 6 [pid 299] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 505] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 25.382198][ T498] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 25.382198][ T498] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.382198][ T498] [ 25.408272][ T498] EXT4-fs (loop5): Magic mismatch, very weird! [ 25.425808][ T504] loop2: detected capacity change from 0 to 512 [pid 503] <... futex resumed>) = 0 [pid 501] ioctl(6, LOOP_SET_FD, 4 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] unlink("./7/binderfs" [pid 295] close(3 [pid 505] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 503] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] <... ioctl resumed>) = 0 [pid 299] lstat("./8/file1", [pid 298] <... unlink resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 505] <... open resumed>) = 5 [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] rmdir("./7" [pid 505] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... rmdir resumed>) = 0 [pid 505] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./7/file1", [pid 295] mkdir("./8", 0777 [pid 505] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 299] <... openat resumed>) = 4 [pid 298] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 299] fstat(4, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... openat resumed>) = 3 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] ioctl(3, LOOP_CLR_FD [pid 299] getdents64(4, [pid 298] <... openat resumed>) = 4 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] fstat(4, [pid 295] close(3 [pid 299] getdents64(4, [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... close resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] getdents64(4, [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] close(4 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] <... close resumed>) = 0 [pid 298] getdents64(4, [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 506 [pid 299] rmdir("./8/file1" [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 298] close(4 [pid 299] getdents64(3, [pid 298] <... close resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] rmdir("./7/file1" [pid 299] close(3 [pid 298] <... rmdir resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] getdents64(3, [pid 299] rmdir("./8" [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 298] close(3 [pid 299] mkdir("./9", 0777 [pid 298] <... close resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 298] rmdir("./7" [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 298] <... rmdir resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 298] mkdir("./8", 0777 [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] <... mkdir resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 299] close(3 [pid 298] <... openat resumed>) = 3 [pid 299] <... close resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 507 [pid 298] <... close resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 508 [pid 501] close(4) = 0 [pid 501] mkdir("./file1", 0777) = 0 [pid 501] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"..../strace-static-x86_64: Process 508 attached ./strace-static-x86_64: Process 507 attached ./strace-static-x86_64: Process 506 attached [pid 503] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 508] set_robust_list(0x555556c9c5e0, 24 [pid 507] set_robust_list(0x555556c9c5e0, 24 [pid 506] set_robust_list(0x555556c9c5e0, 24 [pid 503] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 508] <... set_robust_list resumed>) = 0 [pid 507] <... set_robust_list resumed>) = 0 [pid 506] <... set_robust_list resumed>) = 0 [pid 505] <... futex resumed>) = 0 [pid 503] <... futex resumed>) = 1 [pid 508] chdir("./8" [pid 507] chdir("./9" [pid 506] chdir("./8" [pid 505] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 503] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 508] <... chdir resumed>) = 0 [pid 507] <... chdir resumed>) = 0 [pid 506] <... chdir resumed>) = 0 [pid 505] <... write resumed>) = 262144 [pid 498] +++ exited with 0 +++ [pid 495] +++ exited with 0 +++ [pid 508] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 507] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 506] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 505] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=495, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 508] <... prctl resumed>) = 0 [pid 507] <... prctl resumed>) = 0 [pid 506] <... prctl resumed>) = 0 [pid 505] <... futex resumed>) = 1 [pid 503] <... futex resumed>) = 0 [pid 508] setpgid(0, 0 [pid 507] setpgid(0, 0 [pid 506] setpgid(0, 0 [pid 505] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 508] <... setpgid resumed>) = 0 [pid 507] <... setpgid resumed>) = 0 [pid 506] <... setpgid resumed>) = 0 [pid 508] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 507] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 300] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 508] <... openat resumed>) = 3 [pid 507] <... openat resumed>) = 3 [pid 506] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 508] write(3, "1000", 4 [pid 507] write(3, "1000", 4 [pid 506] <... openat resumed>) = 3 [pid 300] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 508] <... write resumed>) = 4 [pid 507] <... write resumed>) = 4 [pid 506] write(3, "1000", 4 [pid 300] <... openat resumed>) = 3 [pid 508] close(3 [pid 507] close(3 [pid 506] <... write resumed>) = 4 [pid 300] fstat(3, [pid 508] <... close resumed>) = 0 [pid 507] <... close resumed>) = 0 [pid 506] close(3 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 508] symlink("/dev/binderfs", "./binderfs" [pid 507] symlink("/dev/binderfs", "./binderfs" [pid 506] <... close resumed>) = 0 [pid 300] getdents64(3, [pid 508] <... symlink resumed>) = 0 [pid 507] <... symlink resumed>) = 0 [pid 508] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 507] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] symlink("/dev/binderfs", "./binderfs" [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 508] <... futex resumed>) = 0 [pid 507] <... futex resumed>) = 0 [pid 506] <... symlink resumed>) = 0 [pid 300] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 508] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 507] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 506] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = 0 [pid 508] <... mmap resumed>) = 0x7f35deafe000 [pid 507] <... mmap resumed>) = 0x7f35deafe000 [pid 506] <... futex resumed>) = 0 [pid 300] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 508] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 507] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 506] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 508] <... mprotect resumed>) = 0 [pid 507] <... mprotect resumed>) = 0 [pid 506] <... mmap resumed>) = 0x7f35deafe000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 507] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 506] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 300] lstat("./7/bus", [pid 508] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 506] <... mprotect resumed>) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] unlink("./7/bus" [pid 508] <... clone resumed>, parent_tid=[512], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 512 [pid 507] <... clone resumed>, parent_tid=[511], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 511 [pid 506] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 300] <... unlink resumed>) = 0 [pid 508] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 507] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 508] <... futex resumed>) = 0 [pid 507] <... futex resumed>) = 0 [pid 506] <... clone resumed>, parent_tid=[513], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 513 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 508] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 507] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] lstat("./7/binderfs", [pid 508] <... futex resumed>) = 0 [pid 507] <... futex resumed>) = 0 [pid 506] <... futex resumed>) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 508] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 507] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 506] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] unlink("./7/binderfs" [pid 508] <... mmap resumed>) = 0x7f35deadd000 [pid 507] <... mmap resumed>) = 0x7f35deadd000 [pid 506] <... futex resumed>) = 0 [pid 508] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 507] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 506] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 511 attached [pid 508] <... mprotect resumed>) = 0 [pid 507] <... mprotect resumed>) = 0 [pid 506] <... mmap resumed>) = 0x7f35deadd000 [pid 300] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 512 attached [pid 511] set_robust_list(0x7f35deb1e9e0, 24 [pid 508] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 507] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 506] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 512] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 511] <... set_robust_list resumed>) = 0 [pid 508] <... clone resumed>, parent_tid=[514], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 514 [pid 507] <... clone resumed>, parent_tid=[515], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 515 [pid 506] <... mprotect resumed>) = 0 [pid 300] lstat("./7/file1", [pid 512] memfd_create("syzkaller", 0 [pid 511] memfd_create("syzkaller", 0 [pid 508] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 507] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 512] <... memfd_create resumed>) = 3 [pid 512] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 511] <... memfd_create resumed>) = 3 [pid 508] <... futex resumed>) = 0 [pid 507] <... futex resumed>) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 508] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 506] <... clone resumed>, parent_tid=[516], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 516 [pid 300] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 512] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 506] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 506] <... futex resumed>) = 0 [pid 300] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 514 attached ./strace-static-x86_64: Process 513 attached [pid 512] <... write resumed>) = 262144 [pid 511] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 506] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... openat resumed>) = 4 [ 25.449692][ T501] loop1: detected capacity change from 0 to 512 [ 25.450436][ T504] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 25.450436][ T504] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.450436][ T504] [ 25.469376][ T501] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 25.469376][ T501] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.469376][ T501] [pid 514] set_robust_list(0x7f35deafd9e0, 24 [pid 300] fstat(4, ./strace-static-x86_64: Process 516 attached ./strace-static-x86_64: Process 515 attached [pid 513] set_robust_list(0x7f35deb1e9e0, 24 [pid 512] munmap(0x7f35d66dd000, 262144 [pid 511] <... mmap resumed>) = 0x7f35d66dd000 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 516] set_robust_list(0x7f35deafd9e0, 24 [pid 515] set_robust_list(0x7f35deafd9e0, 24 [pid 514] <... set_robust_list resumed>) = 0 [pid 513] <... set_robust_list resumed>) = 0 [pid 511] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 514] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 514] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] getdents64(4, [pid 514] <... futex resumed>) = 1 [pid 513] memfd_create("syzkaller", 0 [pid 508] <... futex resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 514] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 508] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] getdents64(4, [pid 514] <... mount resumed>) = 0 [pid 508] <... futex resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 514] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 508] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] close(4 [pid 516] <... set_robust_list resumed>) = 0 [pid 515] <... set_robust_list resumed>) = 0 [pid 514] <... futex resumed>) = 0 [pid 513] <... memfd_create resumed>) = 3 [pid 512] <... munmap resumed>) = 0 [pid 511] <... write resumed>) = 262144 [pid 508] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] <... close resumed>) = 0 [pid 516] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 515] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 512] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 511] munmap(0x7f35d66dd000, 262144 [pid 508] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] rmdir("./7/file1" [pid 516] <... open resumed>) = 4 [pid 515] <... open resumed>) = 4 [pid 513] <... mmap resumed>) = 0x7f35d66dd000 [pid 512] <... openat resumed>) = 5 [pid 511] <... munmap resumed>) = 0 [pid 508] <... futex resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 516] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 512] ioctl(5, LOOP_SET_FD, 3 [pid 511] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 508] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] getdents64(3, [pid 516] <... futex resumed>) = 1 [pid 515] <... futex resumed>) = 1 [pid 513] <... write resumed>) = 262144 [pid 511] <... openat resumed>) = 5 [pid 507] <... futex resumed>) = 0 [pid 506] <... futex resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 516] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 515] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 513] munmap(0x7f35d66dd000, 262144 [pid 511] ioctl(5, LOOP_SET_FD, 3 [pid 507] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] close(3 [pid 516] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 515] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 514] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 513] <... munmap resumed>) = 0 [ 25.520663][ T509] EXT4-fs warning (device loop2): kmmpd:170: kmmpd being stopped since MMP feature has been disabled. [ 25.533951][ T504] EXT4-fs error (device loop2): __ext4_get_inode_loc:4350: comm syz-executor252: Invalid inode table block 0 in block_group 0 [ 25.538147][ T512] loop3: detected capacity change from 0 to 512 [ 25.548228][ T501] EXT4-fs (loop1): 1 orphan inode deleted [ 25.553897][ T511] loop4: detected capacity change from 0 to 512 [pid 516] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 515] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 513] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 512] <... ioctl resumed>) = 0 [pid 511] <... ioctl resumed>) = 0 [pid 507] <... futex resumed>) = 0 [pid 506] <... futex resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 516] <... mount resumed>) = 0 [pid 515] <... mount resumed>) = 0 [pid 513] <... openat resumed>) = 5 [pid 507] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 506] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] rmdir("./7" [pid 516] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] ioctl(5, LOOP_SET_FD, 3 [pid 300] <... rmdir resumed>) = 0 [pid 516] <... futex resumed>) = 1 [pid 515] <... futex resumed>) = 1 [pid 514] <... open resumed>) = 6 [pid 513] <... ioctl resumed>) = 0 [pid 507] <... futex resumed>) = 0 [pid 506] <... futex resumed>) = 0 [pid 300] mkdir("./8", 0777 [pid 514] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... mkdir resumed>) = 0 [pid 514] <... futex resumed>) = 1 [pid 508] <... futex resumed>) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 514] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 508] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... openat resumed>) = 3 [pid 508] <... futex resumed>) = 0 [pid 300] ioctl(3, LOOP_CLR_FD [pid 508] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] close(3) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 519 [pid 514] <... write resumed>) = 262144 [pid 514] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 508] <... futex resumed>) = 0 [pid 514] <... futex resumed>) = 1 [pid 514] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 511] close(3) = 0 [pid 511] mkdir("./file1", 0777) = 0 [pid 516] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 515] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 513] close(3 [pid 507] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 515] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 513] <... close resumed>) = 0 [pid 512] close(3 [pid 501] <... mount resumed>) = 0 [ 25.562835][ T501] EXT4-fs (loop1): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 25.566609][ T513] loop0: detected capacity change from 0 to 512 [ 25.587834][ T504] EXT4-fs (loop2): get root inode failed [ 25.593437][ T501] ext4 filesystem being mounted at /root/syzkaller.5s3MMz/7/file1 supports timestamps until 2038 (0x7fffffff) [ 25.611597][ T504] EXT4-fs (loop2): mount failed [pid 511] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"..../strace-static-x86_64: Process 519 attached [pid 516] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 515] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 513] mkdir("./file1", 0777 [pid 512] <... close resumed>) = 0 [pid 507] <... futex resumed>) = 0 [pid 506] <... futex resumed>) = 0 [pid 504] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 501] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 516] <... open resumed>) = 3 [pid 515] <... open resumed>) = 3 [pid 513] <... mkdir resumed>) = 0 [pid 512] mkdir("./file1", 0777 [pid 507] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 506] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] <... openat resumed>) = 4 [pid 516] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 512] <... mkdir resumed>) = 0 [pid 501] chdir("./file1" [pid 516] <... futex resumed>) = 1 [pid 515] <... futex resumed>) = 1 [pid 512] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 507] <... futex resumed>) = 0 [pid 506] <... futex resumed>) = 0 [pid 501] <... chdir resumed>) = 0 [pid 516] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 515] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 507] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 506] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 501] ioctl(6, LOOP_CLR_FD [pid 516] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 515] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 507] <... futex resumed>) = 0 [pid 506] <... futex resumed>) = 0 [pid 501] <... ioctl resumed>) = 0 [pid 516] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 515] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 507] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 506] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] close(6) = 0 [pid 501] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 501] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 504] ioctl(4, LOOP_CLR_FD) = 0 [pid 504] close(4) = 0 [pid 519] set_robust_list(0x555556c9c5e0, 24 [pid 504] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 504] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 519] <... set_robust_list resumed>) = 0 [pid 519] chdir("./8" [pid 503] exit_group(0 [pid 500] exit_group(0 [pid 503] <... exit_group resumed>) = ? [pid 501] <... futex resumed>) = ? [pid 500] <... exit_group resumed>) = ? [pid 501] +++ exited with 0 +++ [pid 504] <... futex resumed>) = ? [pid 504] +++ exited with 0 +++ [pid 519] <... chdir resumed>) = 0 [pid 519] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 519] setpgid(0, 0) = 0 [pid 519] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 519] write(3, "1000", 4) = 4 [pid 519] close(3) = 0 [pid 519] symlink("/dev/binderfs", "./binderfs") = 0 [pid 519] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 519] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 519] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[520], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 520 [pid 519] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 519] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 519] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[521], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 521 [pid 519] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 520 attached [pid 520] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 520] memfd_create("syzkaller", 0) = 3 [pid 520] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 505] <... futex resumed>) = ? [pid 502] <... futex resumed>) = ? [pid 520] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 520] munmap(0x7f35d66dd000, 262144) = 0 [pid 502] +++ exited with 0 +++ [pid 500] +++ exited with 0 +++ [pid 520] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [ 25.612699][ T511] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 25.612699][ T511] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.612699][ T511] [ 25.634687][ T513] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 25.634687][ T513] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.634687][ T513] [ 25.652921][ T512] EXT4-fs (loop3): VFS: Can't find ext4 filesystem [pid 520] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 521 attached [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=500, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 520] <... ioctl resumed>) = 0 [pid 516] <... write resumed>) = 262144 [pid 515] <... write resumed>) = 262144 [pid 512] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 516] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 512] ioctl(5, LOOP_CLR_FD [pid 516] <... futex resumed>) = 1 [pid 515] <... futex resumed>) = 1 [pid 512] <... ioctl resumed>) = 0 [pid 521] set_robust_list(0x7f35deafd9e0, 24 [pid 520] close(3 [pid 507] <... futex resumed>) = 0 [pid 506] <... futex resumed>) = 0 [pid 516] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 515] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 512] close(5) = 0 [pid 512] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 512] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 511] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 520] <... close resumed>) = 0 [pid 521] <... set_robust_list resumed>) = 0 [pid 511] ioctl(5, LOOP_CLR_FD [pid 521] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 520] mkdir("./file1", 0777 [pid 508] exit_group(0 [pid 514] <... futex resumed>) = ? [pid 512] <... futex resumed>) = ? [pid 508] <... exit_group resumed>) = ? [pid 521] <... open resumed>) = 3 [pid 520] <... mkdir resumed>) = 0 [pid 514] +++ exited with 0 +++ [pid 512] +++ exited with 0 +++ [pid 296] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 521] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 520] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 296] <... openat resumed>) = 3 [pid 521] <... futex resumed>) = 1 [pid 519] <... futex resumed>) = 0 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 521] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 519] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 519] <... futex resumed>) = 0 [pid 511] <... ioctl resumed>) = 0 [pid 296] getdents64(3, [pid 521] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 519] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 521] <... mount resumed>) = 0 [pid 521] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 519] <... futex resumed>) = 0 [pid 521] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 519] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 519] <... futex resumed>) = 0 [pid 521] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 519] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 521] <... open resumed>) = 5 [pid 521] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 519] <... futex resumed>) = 0 [pid 521] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 519] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 519] <... futex resumed>) = 0 [pid 521] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 519] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 511] close(5) = 0 [pid 511] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 511] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 507] exit_group(0) = ? [pid 521] <... write resumed>) = 262144 [pid 521] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] <... futex resumed>) = 0 [pid 521] <... futex resumed>) = 1 [pid 521] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 515] <... futex resumed>) = ? [pid 513] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 505] +++ exited with 0 +++ [pid 503] +++ exited with 0 +++ [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 513] ioctl(5, LOOP_CLR_FD) = 0 [pid 513] close(5) = 0 [pid 513] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 513] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 506] exit_group(0) = ? [pid 513] <... futex resumed>) = ? [pid 513] +++ exited with 0 +++ [pid 511] <... futex resumed>) = ? [pid 511] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=503, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 516] <... futex resumed>) = ? [pid 296] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 520] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 297] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 508] +++ exited with 0 +++ [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./7/bus", [pid 296] lstat("./7/bus", [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=508, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 520] ioctl(4, LOOP_CLR_FD [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 297] unlink("./7/bus" [pid 296] unlink("./7/bus" [pid 298] <... restart_syscall resumed>) = 0 [pid 520] <... ioctl resumed>) = 0 [pid 520] close(4) = 0 [pid 520] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] <... unlink resumed>) = 0 [pid 520] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... unlink resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 519] exit_group(0 [pid 298] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] lstat("./7/binderfs", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 521] <... futex resumed>) = ? [pid 519] <... exit_group resumed>) = ? [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] lstat("./7/binderfs", [pid 521] +++ exited with 0 +++ [pid 520] <... futex resumed>) = ? [pid 298] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] unlink("./7/binderfs" [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] <... openat resumed>) = 3 [pid 297] <... unlink resumed>) = 0 [pid 296] unlink("./7/binderfs" [pid 298] fstat(3, [pid 297] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... unlink resumed>) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(3, [pid 297] lstat("./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] fstat(4, [pid 298] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./7/file1" [pid 298] <... umount2 resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 297] getdents64(3, [pid 298] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] close(3 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... close resumed>) = 0 [pid 297] rmdir("./7" [pid 298] lstat("./8/bus", [pid 297] <... rmdir resumed>) = 0 [pid 297] mkdir("./8", 0777 [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 298] unlink("./8/bus" [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 298] <... unlink resumed>) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 298] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... close resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] lstat("./8/binderfs", ./strace-static-x86_64: Process 522 attached [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 522 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 522] set_robust_list(0x555556c9c5e0, 24 [pid 298] unlink("./8/binderfs") = 0 [pid 298] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 522] <... set_robust_list resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 522] chdir("./8" [pid 298] lstat("./8/file1", [pid 522] <... chdir resumed>) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 522] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 522] <... prctl resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 522] setpgid(0, 0 [pid 298] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 522] <... setpgid resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 522] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] fstat(4, [pid 522] <... openat resumed>) = 3 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 522] write(3, "1000", 4 [pid 298] getdents64(4, [pid 522] <... write resumed>) = 4 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 522] close(3 [pid 298] getdents64(4, [pid 522] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 522] symlink("/dev/binderfs", "./binderfs" [pid 298] close(4 [pid 522] <... symlink resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 522] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] rmdir("./8/file1" [pid 522] <... futex resumed>) = 0 [pid 522] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 522] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 298] <... rmdir resumed>) = 0 [pid 522] <... mprotect resumed>) = 0 [pid 298] getdents64(3, [pid 522] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 523 attached [pid 523] set_robust_list(0x7f35deb1e9e0, 24 [pid 522] <... clone resumed>, parent_tid=[523], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 523 [pid 298] close(3 [pid 522] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 522] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 522] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 522] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 298] <... close resumed>) = 0 [pid 522] <... mprotect resumed>) = 0 [pid 522] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 523] <... set_robust_list resumed>) = 0 [pid 298] rmdir("./8"./strace-static-x86_64: Process 524 attached [pid 522] <... clone resumed>, parent_tid=[524], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 524 [pid 522] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 522] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... rmdir resumed>) = 0 [pid 523] memfd_create("syzkaller", 0 [pid 298] mkdir("./9", 0777 [pid 524] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 524] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 524] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... mkdir resumed>) = 0 [pid 524] <... futex resumed>) = 1 [pid 522] <... futex resumed>) = 0 [pid 524] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 522] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 524] <... mount resumed>) = 0 [pid 523] <... memfd_create resumed>) = 4 [pid 522] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 524] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 522] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 524] <... futex resumed>) = 0 [pid 523] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 522] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... openat resumed>) = 3 [pid 524] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 522] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 524] <... open resumed>) = 5 [pid 523] <... mmap resumed>) = 0x7f35d66dd000 [pid 522] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 524] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 522] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 524] <... futex resumed>) = 0 [pid 522] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 524] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 522] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 524] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 522] <... futex resumed>) = 0 [pid 524] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 522] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 524] <... futex resumed>) = 0 [pid 522] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 524] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 523] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 298] close(3 [pid 523] <... write resumed>) = 262144 [pid 523] munmap(0x7f35d66dd000, 262144 [pid 298] <... close resumed>) = 0 [pid 523] <... munmap resumed>) = 0 [ 25.666209][ T520] loop5: detected capacity change from 0 to 512 [ 25.671612][ T511] EXT4-fs (loop4): Magic mismatch, very weird! [ 25.682391][ T520] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 25.682391][ T520] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.682391][ T520] [ 25.700062][ T513] EXT4-fs (loop0): Magic mismatch, very weird! [ 25.712945][ T520] EXT4-fs (loop5): Magic mismatch, very weird! [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 523] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 6 [pid 523] ioctl(6, LOOP_SET_FD, 4./strace-static-x86_64: Process 525 attached [pid 525] set_robust_list(0x555556c9c5e0, 24 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 525 [pid 523] <... ioctl resumed>) = 0 [pid 516] +++ exited with 0 +++ [pid 515] +++ exited with 0 +++ [pid 507] +++ exited with 0 +++ [pid 506] +++ exited with 0 +++ [pid 523] close(4) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=507, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 523] mkdir("./file1", 0777 [pid 299] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 523] <... mkdir resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 523] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 299] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 525] <... set_robust_list resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 525] chdir("./9" [pid 299] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=506, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 525] <... chdir resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 525] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 299] lstat("./9/bus", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 525] <... prctl resumed>) = 0 [pid 295] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 525] setpgid(0, 0 [pid 295] <... openat resumed>) = 3 [pid 525] <... setpgid resumed>) = 0 [pid 295] fstat(3, [pid 525] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 525] <... openat resumed>) = 3 [pid 520] +++ exited with 0 +++ [pid 519] +++ exited with 0 +++ [pid 296] <... umount2 resumed>) = 0 [pid 295] getdents64(3, [pid 525] write(3, "1000", 4 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=519, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 296] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 525] <... write resumed>) = 4 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 525] close(3 [pid 296] lstat("./7/file1", [pid 525] <... close resumed>) = 0 [pid 300] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 525] symlink("/dev/binderfs", "./binderfs" [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 525] <... symlink resumed>) = 0 [pid 300] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 525] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... openat resumed>) = 3 [pid 296] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 525] <... futex resumed>) = 0 [pid 300] fstat(3, [pid 296] <... openat resumed>) = 4 [pid 525] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] fstat(4, [pid 525] <... mmap resumed>) = 0x7f35deafe000 [pid 300] getdents64(3, [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 525] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] getdents64(4, [pid 525] <... mprotect resumed>) = 0 [pid 300] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 525] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 525] <... clone resumed>, parent_tid=[526], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 526 [pid 296] close(4 [pid 525] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 525] <... futex resumed>) = 0 [pid 296] rmdir("./7/file1" [pid 525] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... rmdir resumed>) = 0 [pid 525] <... futex resumed>) = 0 [pid 296] getdents64(3, [pid 525] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 525] <... mmap resumed>) = 0x7f35deadd000 [pid 296] close(3 [pid 525] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 296] <... close resumed>) = 0 [pid 525] <... mprotect resumed>) = 0 [pid 296] rmdir("./7" [pid 525] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./8", 0777 [pid 525] <... clone resumed>, parent_tid=[527], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 527 [pid 296] <... mkdir resumed>) = 0 [pid 525] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 525] <... futex resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 525] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 528 ./strace-static-x86_64: Process 527 attached [pid 527] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 527] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 527] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... futex resumed>) = 0 [pid 525] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... futex resumed>) = 1 [pid 300] <... umount2 resumed>) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 300] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] unlink("./9/bus" [pid 295] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... unlink resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./8/bus", [pid 299] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] lstat("./8/bus", [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] unlink("./8/bus" [pid 299] lstat("./9/binderfs", [pid 295] unlink("./8/bus" [pid 300] <... unlink resumed>) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 528 attached [pid 300] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] unlink("./9/binderfs" [pid 295] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 528] set_robust_list(0x555556c9c5e0, 24 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... unlink resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 528] <... set_robust_list resumed>) = 0 [pid 300] lstat("./8/binderfs", [pid 299] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] lstat("./8/binderfs", [pid 528] chdir("./8" [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 ./strace-static-x86_64: Process 526 attached [pid 528] <... chdir resumed>) = 0 [pid 300] unlink("./8/binderfs" [pid 299] lstat("./9/file1", [pid 295] unlink("./8/binderfs" [pid 528] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 527] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 526] set_robust_list(0x7f35deb1e9e0, 24 [pid 300] <... unlink resumed>) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... unlink resumed>) = 0 [pid 528] <... prctl resumed>) = 0 [pid 527] <... mount resumed>) = 0 [pid 526] <... set_robust_list resumed>) = 0 [pid 300] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 528] setpgid(0, 0 [pid 527] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] memfd_create("syzkaller", 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 528] <... setpgid resumed>) = 0 [pid 527] <... futex resumed>) = 1 [pid 526] <... memfd_create resumed>) = 4 [pid 525] <... futex resumed>) = 0 [ 25.739948][ T523] loop2: detected capacity change from 0 to 512 [ 25.754047][ T523] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 25.754047][ T523] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.754047][ T523] [pid 300] lstat("./8/file1", [pid 299] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] lstat("./8/file1", [pid 528] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 527] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 526] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 525] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... openat resumed>) = 4 [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 528] <... openat resumed>) = 3 [pid 526] <... mmap resumed>) = 0x7f35d66dd000 [pid 525] <... futex resumed>) = 0 [pid 300] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] fstat(4, [pid 295] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 528] write(3, "1000", 4 [pid 526] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 525] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 528] <... write resumed>) = 4 [pid 526] <... write resumed>) = 262144 [pid 300] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] getdents64(4, [pid 295] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 528] close(3 [pid 526] munmap(0x7f35d66dd000, 262144 [pid 300] <... openat resumed>) = 4 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 528] <... close resumed>) = 0 [pid 526] <... munmap resumed>) = 0 [pid 300] fstat(4, [pid 299] getdents64(4, [pid 295] <... openat resumed>) = 4 [pid 528] symlink("/dev/binderfs", "./binderfs" [pid 526] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] fstat(4, [pid 528] <... symlink resumed>) = 0 [pid 526] <... openat resumed>) = 5 [pid 300] getdents64(4, [pid 299] close(4 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 528] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] ioctl(5, LOOP_SET_FD, 4 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] <... close resumed>) = 0 [pid 295] getdents64(4, [pid 528] <... futex resumed>) = 0 [pid 300] getdents64(4, [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] getdents64(4, [pid 300] close(4 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] <... close resumed>) = 0 [pid 295] close(4 [pid 300] rmdir("./8/file1" [pid 295] <... close resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 295] rmdir("./8/file1" [pid 300] getdents64(3, [pid 295] <... rmdir resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] getdents64(3, [pid 300] close(3 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] <... close resumed>) = 0 [pid 295] close(3 [pid 300] rmdir("./8" [pid 295] <... close resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 295] rmdir("./8" [pid 528] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] mkdir("./9", 0777 [pid 299] rmdir("./9/file1" [pid 295] <... rmdir resumed>) = 0 [pid 528] <... mmap resumed>) = 0x7f35deafe000 [pid 526] <... ioctl resumed>) = 0 [pid 300] <... mkdir resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 528] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 526] close(4 [pid 299] getdents64(3, [pid 528] <... mprotect resumed>) = 0 [pid 526] <... close resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 528] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 526] mkdir("./file1", 0777 [pid 299] close(3 [pid 526] <... mkdir resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 528] <... clone resumed>, parent_tid=[531], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 531 [pid 526] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 299] rmdir("./9" [pid 528] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... rmdir resumed>) = 0 [pid 528] <... futex resumed>) = 0 [pid 299] mkdir("./10", 0777 [pid 528] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... mkdir resumed>) = 0 [pid 528] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 528] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 527] <... open resumed>) = 6 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 299] <... openat resumed>) = 3 [pid 295] mkdir("./9", 0777 [pid 528] <... mmap resumed>) = 0x7f35deadd000 [pid 299] ioctl(3, LOOP_CLR_FD [pid 528] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 528] <... mprotect resumed>) = 0 [pid 299] close(3 [pid 528] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 299] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 528] <... clone resumed>, parent_tid=[532], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 532 [pid 528] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 533 [pid 528] <... futex resumed>) = 0 [pid 528] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 531 attached [pid 300] <... openat resumed>) = 3 [pid 531] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 531] memfd_create("syzkaller", 0) = 3 [pid 531] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 300] ioctl(3, LOOP_CLR_FD [pid 527] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 531] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 527] <... futex resumed>) = 1 [pid 525] <... futex resumed>) = 0 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... openat resumed>) = 3 [pid 525] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] close(3 [pid 295] ioctl(3, LOOP_CLR_FD [pid 525] <... futex resumed>) = 0 [pid 527] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 300] <... close resumed>) = 0 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 525] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] close(3 [pid 531] <... write resumed>) = 262144 [pid 531] munmap(0x7f35d66dd000, 262144) = 0 [pid 295] <... close resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 531] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 531] ioctl(4, LOOP_SET_FD, 3 [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 534 [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 535 ./strace-static-x86_64: Process 534 attached [pid 534] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 534] chdir("./9") = 0 [ 25.799696][ T526] loop3: detected capacity change from 0 to 512 [ 25.810147][ T526] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 25.810147][ T526] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.810147][ T526] [ 25.814929][ T523] EXT4-fs (loop2): 1 orphan inode deleted [ 25.843362][ T531] loop1: detected capacity change from 0 to 512 [pid 534] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 534] setpgid(0, 0) = 0 [pid 534] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 534] write(3, "1000", 4) = 4 [pid 534] close(3) = 0 [pid 534] symlink("/dev/binderfs", "./binderfs") = 0 [pid 534] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 534] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 534] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[536], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 536 [pid 534] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 534] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 534] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[537], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 537 [pid 534] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 531] <... ioctl resumed>) = 0 [pid 531] close(3) = 0 [pid 531] mkdir("./file1", 0777) = 0 [pid 531] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 527] <... write resumed>) = 262144 [pid 527] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 525] <... futex resumed>) = 0 [pid 527] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 528] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 528] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 528] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35d66fc000 [pid 528] mprotect(0x7f35d66fd000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 528] clone(child_stack=0x7f35d671c3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[538], tls=0x7f35d671c700, child_tidptr=0x7f35d671c9d0) = 538 [ 25.844599][ T526] EXT4-fs warning (device loop3): read_mmp_block:115: Error -117 while reading MMP block 8 [ 25.868160][ T523] EXT4-fs (loop2): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 25.869109][ T531] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [pid 528] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 528] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 538 attached ./strace-static-x86_64: Process 537 attached ./strace-static-x86_64: Process 536 attached ./strace-static-x86_64: Process 535 attached ./strace-static-x86_64: Process 533 attached ./strace-static-x86_64: Process 532 attached [pid 534] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 526] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 538] set_robust_list(0x7f35d671c9e0, 24 [pid 537] set_robust_list(0x7f35deafd9e0, 24 [pid 536] set_robust_list(0x7f35deb1e9e0, 24 [pid 535] set_robust_list(0x555556c9c5e0, 24 [pid 534] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] set_robust_list(0x555556c9c5e0, 24 [pid 532] set_robust_list(0x7f35deafd9e0, 24 [pid 526] ioctl(5, LOOP_CLR_FD [pid 537] <... set_robust_list resumed>) = 0 [pid 536] <... set_robust_list resumed>) = 0 [pid 534] <... futex resumed>) = 0 [pid 532] <... set_robust_list resumed>) = 0 [pid 526] <... ioctl resumed>) = 0 [pid 538] <... set_robust_list resumed>) = 0 [pid 535] <... set_robust_list resumed>) = 0 [pid 533] <... set_robust_list resumed>) = 0 [pid 537] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 536] memfd_create("syzkaller", 0 [pid 534] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 532] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 538] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 535] chdir("./9" [pid 526] close(5 [pid 533] chdir("./10" [pid 538] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 526] <... close resumed>) = 0 [pid 523] <... mount resumed>) = 0 [pid 523] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 523] chdir("./file1" [pid 538] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 537] <... open resumed>) = 3 [pid 536] <... memfd_create resumed>) = 4 [pid 535] <... chdir resumed>) = 0 [pid 534] <... mmap resumed>) = 0x7f35deabc000 [pid 533] <... chdir resumed>) = 0 [pid 532] <... open resumed>) = 3 [pid 526] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 523] <... chdir resumed>) = 0 [pid 538] <... futex resumed>) = 1 [pid 537] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 535] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 534] mprotect(0x7f35deabd000, 131072, PROT_READ|PROT_WRITE [pid 533] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 532] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 528] <... futex resumed>) = 0 [pid 526] <... futex resumed>) = 0 [pid 525] exit_group(0 [pid 528] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 537] <... futex resumed>) = 0 [pid 536] <... mmap resumed>) = 0x7f35d66bc000 [pid 535] <... prctl resumed>) = 0 [pid 534] <... mprotect resumed>) = 0 [pid 533] <... prctl resumed>) = 0 [pid 532] <... futex resumed>) = 0 [pid 528] <... futex resumed>) = 0 [pid 527] <... futex resumed>) = ? [pid 525] <... exit_group resumed>) = ? [pid 537] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 535] setpgid(0, 0 [pid 534] clone(child_stack=0x7f35deadc3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 533] setpgid(0, 0 [pid 532] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 528] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] +++ exited with 0 +++ [pid 526] +++ exited with 0 +++ [pid 523] ioctl(6, LOOP_CLR_FD [pid 532] <... open resumed>) = 5 [pid 532] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 532] <... futex resumed>) = 1 [pid 528] <... futex resumed>) = 0 [pid 532] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 528] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] <... setpgid resumed>) = 0 [pid 533] <... setpgid resumed>) = 0 [pid 532] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 528] <... futex resumed>) = 0 [pid 535] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 533] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 532] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 528] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 534] <... clone resumed>, parent_tid=[541], tls=0x7f35deadc700, child_tidptr=0x7f35deadc9d0) = 541 [pid 536] <... write resumed>) = 262144 [pid 535] <... openat resumed>) = 3 [pid 533] <... openat resumed>) = 3 [pid 534] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] write(3, "1000", 4 [pid 533] write(3, "1000", 4./strace-static-x86_64: Process 541 attached [pid 536] munmap(0x7f35d66bc000, 262144 [pid 535] <... write resumed>) = 4 [pid 534] <... futex resumed>) = 0 [pid 523] <... ioctl resumed>) = 0 [pid 536] <... munmap resumed>) = 0 [pid 535] close(3 [pid 534] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 533] <... write resumed>) = 4 [pid 535] <... close resumed>) = 0 [pid 533] close(3 [pid 536] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 535] symlink("/dev/binderfs", "./binderfs" [pid 533] <... close resumed>) = 0 [ 25.869109][ T531] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 25.869109][ T531] [ 25.893058][ T523] ext4 filesystem being mounted at /root/syzkaller.7ngmbG/8/file1 supports timestamps until 2038 (0x7fffffff) [ 25.933130][ T531] EXT4-fs (loop1): 1 orphan inode deleted [pid 536] <... openat resumed>) = 5 [pid 535] <... symlink resumed>) = 0 [pid 533] symlink("/dev/binderfs", "./binderfs" [pid 536] ioctl(5, LOOP_SET_FD, 4 [pid 535] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] <... symlink resumed>) = 0 [pid 535] <... futex resumed>) = 0 [pid 533] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] +++ exited with 0 +++ [pid 535] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 533] <... futex resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=525, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 535] <... mmap resumed>) = 0x7f35deafe000 [pid 533] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 535] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 533] <... mmap resumed>) = 0x7f35deafe000 [pid 535] <... mprotect resumed>) = 0 [pid 533] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 298] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 535] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 533] <... mprotect resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 533] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 535] <... clone resumed>, parent_tid=[542], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 542 [pid 298] <... openat resumed>) = 3 [pid 535] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] <... clone resumed>, parent_tid=[543], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 543 [pid 298] fstat(3, [pid 535] <... futex resumed>) = 0 [pid 533] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 535] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 535] <... futex resumed>) = 0 [pid 533] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 535] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 533] <... futex resumed>) = 0 [pid 298] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 535] <... mmap resumed>) = 0x7f35deadd000 [pid 533] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 535] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 533] <... mmap resumed>) = 0x7f35deadd000 [pid 535] <... mprotect resumed>) = 0 [pid 533] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 535] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 533] <... mprotect resumed>) = 0 [pid 533] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 535] <... clone resumed>, parent_tid=[544], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 544 [pid 298] <... umount2 resumed>) = 0 [pid 531] <... mount resumed>) = 0 [pid 531] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 535] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] <... clone resumed>, parent_tid=[545], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 545 [pid 298] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 533] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 535] <... futex resumed>) = 0 [pid 533] <... futex resumed>) = 0 [pid 298] lstat("./9/bus", [pid 535] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 533] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 531] <... openat resumed>) = 6 [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 531] chdir("./file1" [pid 298] unlink("./9/bus" [pid 531] <... chdir resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 531] ioctl(4, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 531] <... ioctl resumed>) = 0 [pid 298] lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] unlink("./9/binderfs") = 0 [pid 298] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./9/file1", [pid 531] close(4 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 531] <... close resumed>) = 0 [pid 298] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 531] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 531] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 531] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... openat resumed>) = 4 [pid 298] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 528] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 298] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./9/file1") = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./9") = 0 [pid 541] set_robust_list(0x7f35deadc9e0, 24 [pid 523] close(6 [pid 298] mkdir("./10", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 541] <... set_robust_list resumed>) = 0 [pid 534] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 523] <... close resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 534] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 537] <... futex resumed>) = 0 [pid 534] <... futex resumed>) = 1 [pid 298] close(3 [pid 537] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 534] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... close resumed>) = 0 [pid 537] <... open resumed>) = 6 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 537] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 541] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 537] <... futex resumed>) = 1 [pid 534] <... futex resumed>) = 0 [pid 523] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 546 [pid 541] <... mount resumed>) = 0 [pid 537] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 523] <... futex resumed>) = 0 ./strace-static-x86_64: Process 546 attached [pid 541] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 537] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 534] <... futex resumed>) = 0 [pid 523] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 541] <... futex resumed>) = 0 [pid 537] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 534] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] exit_group(0 [pid 546] set_robust_list(0x555556c9c5e0, 24 [pid 541] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 524] <... futex resumed>) = ? [pid 523] <... futex resumed>) = ? [pid 522] <... exit_group resumed>) = ? [pid 546] <... set_robust_list resumed>) = 0 [pid 524] +++ exited with 0 +++ [pid 523] +++ exited with 0 +++ ./strace-static-x86_64: Process 545 attached ./strace-static-x86_64: Process 544 attached ./strace-static-x86_64: Process 543 attached ./strace-static-x86_64: Process 542 attached [pid 546] chdir("./10" [pid 522] +++ exited with 0 +++ [pid 546] <... chdir resumed>) = 0 [pid 546] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=522, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 546] setpgid(0, 0 [pid 297] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 546] <... setpgid resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 546] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 545] set_robust_list(0x7f35deafd9e0, 24 [pid 544] set_robust_list(0x7f35deafd9e0, 24 [pid 543] set_robust_list(0x7f35deb1e9e0, 24 [pid 542] set_robust_list(0x7f35deb1e9e0, 24 [pid 297] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 546] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 545] <... set_robust_list resumed>) = 0 [pid 544] <... set_robust_list resumed>) = 0 [pid 543] <... set_robust_list resumed>) = 0 [pid 542] <... set_robust_list resumed>) = 0 [pid 546] write(3, "1000", 4 [pid 545] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 544] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 543] memfd_create("syzkaller", 0 [pid 542] memfd_create("syzkaller", 0 [pid 297] fstat(3, [pid 546] <... write resumed>) = 4 [pid 545] <... open resumed>) = 3 [pid 544] <... open resumed>) = 3 [pid 543] <... memfd_create resumed>) = 4 [pid 542] <... memfd_create resumed>) = 4 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 546] close(3 [pid 545] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 544] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 543] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 542] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 297] getdents64(3, [pid 546] <... close resumed>) = 0 [pid 545] <... futex resumed>) = 1 [ 25.939043][ T531] EXT4-fs (loop1): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 25.948281][ T536] loop5: detected capacity change from 0 to 512 [ 25.962970][ T531] ext4 filesystem being mounted at /root/syzkaller.5s3MMz/8/file1 supports timestamps until 2038 (0x7fffffff) [pid 544] <... futex resumed>) = 1 [pid 543] <... mmap resumed>) = 0x7f35d66dd000 [pid 542] <... mmap resumed>) = 0x7f35d66dd000 [pid 535] <... futex resumed>) = 0 [pid 533] <... futex resumed>) = 0 [pid 546] symlink("/dev/binderfs", "./binderfs" [pid 545] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 544] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 543] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 542] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 535] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 546] <... symlink resumed>) = 0 [pid 545] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 544] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 535] <... futex resumed>) = 0 [pid 533] <... futex resumed>) = 0 [pid 297] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 546] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 545] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 544] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 543] <... write resumed>) = 262144 [pid 542] <... write resumed>) = 262144 [pid 535] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 533] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 546] <... futex resumed>) = 0 [pid 545] <... mount resumed>) = 0 [pid 544] <... mount resumed>) = 0 [pid 543] munmap(0x7f35d66dd000, 262144 [pid 542] munmap(0x7f35d66dd000, 262144 [pid 297] <... umount2 resumed>) = 0 [pid 546] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 545] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 544] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 543] <... munmap resumed>) = 0 [pid 542] <... munmap resumed>) = 0 [pid 297] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 546] <... mmap resumed>) = 0x7f35deafe000 [pid 545] <... futex resumed>) = 1 [pid 544] <... futex resumed>) = 1 [pid 543] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 542] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 535] <... futex resumed>) = 0 [pid 533] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 546] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 545] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 544] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 543] <... openat resumed>) = 5 [pid 542] <... openat resumed>) = 5 [pid 535] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] lstat("./8/bus", [pid 546] <... mprotect resumed>) = 0 [pid 545] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 544] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 543] ioctl(5, LOOP_SET_FD, 4 [pid 542] ioctl(5, LOOP_SET_FD, 4 [pid 535] <... futex resumed>) = 0 [pid 533] <... futex resumed>) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 546] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 545] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 544] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 543] <... ioctl resumed>) = 0 [pid 535] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 533] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] unlink("./8/bus" [pid 545] <... open resumed>) = 6 [pid 545] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 533] <... futex resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 546] <... clone resumed>, parent_tid=[547], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 547 [pid 546] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 545] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 533] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 546] <... futex resumed>) = 0 [pid 545] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 533] <... futex resumed>) = 0 [pid 546] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 545] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 533] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 546] <... futex resumed>) = 0 [pid 545] <... write resumed>) = 262144 [pid 297] lstat("./8/binderfs", [pid 546] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 545] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 546] <... mmap resumed>) = 0x7f35deadd000 [pid 545] <... futex resumed>) = 1 [pid 534] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 533] <... futex resumed>) = 0 [pid 545] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] unlink("./8/binderfs" [pid 546] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 297] <... unlink resumed>) = 0 [pid 546] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 548 attached [pid 548] set_robust_list(0x7f35deafd9e0, 24 [pid 546] <... clone resumed>, parent_tid=[548], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 548 [pid 548] <... set_robust_list resumed>) = 0 [pid 546] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 548] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 546] <... futex resumed>) = 0 [pid 548] <... open resumed>) = 3 [pid 546] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 548] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 548] <... futex resumed>) = 0 [pid 546] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 548] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 546] <... futex resumed>) = 0 [pid 548] <... mount resumed>) = 0 [pid 546] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 548] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 548] <... futex resumed>) = 0 [pid 546] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 548] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 546] <... futex resumed>) = 0 [pid 544] <... open resumed>) = 6 [pid 544] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 543] close(4 [pid 542] <... ioctl resumed>) = 0 [pid 548] <... open resumed>) = 4 [pid 546] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 544] <... futex resumed>) = 1 [pid 543] <... close resumed>) = 0 [pid 542] close(4 [pid 535] <... futex resumed>) = 0 [pid 548] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 544] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 535] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 548] <... futex resumed>) = 0 [pid 546] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 544] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 543] mkdir("./file1", 0777 [pid 542] <... close resumed>) = 0 [pid 535] <... futex resumed>) = 0 ./strace-static-x86_64: Process 547 attached [pid 548] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 546] <... futex resumed>) = 0 [pid 544] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 543] <... mkdir resumed>) = 0 [pid 542] mkdir("./file1", 0777 [pid 535] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 548] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 547] set_robust_list(0x7f35deb1e9e0, 24 [pid 546] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 544] <... write resumed>) = 262144 [pid 543] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 542] <... mkdir resumed>) = 0 [ 26.046574][ T543] loop4: detected capacity change from 0 to 512 [ 26.052924][ T542] loop0: detected capacity change from 0 to 512 [pid 548] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] <... set_robust_list resumed>) = 0 [pid 546] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 544] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 543] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 542] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 548] <... futex resumed>) = 0 [pid 547] memfd_create("syzkaller", 0 [pid 544] <... futex resumed>) = 1 [pid 542] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 535] <... futex resumed>) = 0 [pid 548] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 547] <... memfd_create resumed>) = 5 [pid 544] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 547] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 297] <... umount2 resumed>) = 0 [pid 547] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 297] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] <... write resumed>) = 262144 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./8/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] munmap(0x7f35d66dd000, 262144 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 547] <... munmap resumed>) = 0 [pid 536] <... ioctl resumed>) = 0 [pid 297] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 547] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 536] close(4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 547] <... openat resumed>) = 6 [pid 536] <... close resumed>) = 0 [pid 297] getdents64(4, [pid 547] ioctl(6, LOOP_SET_FD, 5 [pid 536] mkdir("./file1", 0777 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 536] <... mkdir resumed>) = 0 [pid 297] getdents64(4, [ 26.087607][ T543] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 26.096319][ T542] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [ 26.114196][ T547] loop3: detected capacity change from 0 to 512 [ 26.121902][ T536] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 26.121902][ T536] Contact linux-ext4@vger.kernel.org if you think we should keep it. [pid 536] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./8/file1") = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./8") = 0 [pid 297] mkdir("./9", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 549 [pid 542] ioctl(5, LOOP_CLR_FD) = 0 [pid 542] close(5) = 0 [pid 542] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 542] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 535] exit_group(0 [pid 544] <... futex resumed>) = ? [pid 542] <... futex resumed>) = ? [pid 535] <... exit_group resumed>) = ? [pid 544] +++ exited with 0 +++ [pid 542] +++ exited with 0 +++ ./strace-static-x86_64: Process 549 attached [pid 549] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 549] chdir("./9") = 0 [pid 549] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 549] setpgid(0, 0) = 0 [pid 543] ioctl(5, LOOP_CLR_FD [pid 549] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 547] <... ioctl resumed>) = 0 [pid 543] <... ioctl resumed>) = 0 [pid 549] write(3, "1000", 4 [pid 547] close(5 [pid 543] close(5 [pid 549] <... write resumed>) = 4 [pid 547] <... close resumed>) = 0 [pid 543] <... close resumed>) = 0 [pid 549] close(3 [pid 547] mkdir("./file1", 0777 [pid 543] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 549] <... close resumed>) = 0 [pid 547] <... mkdir resumed>) = 0 [pid 543] <... futex resumed>) = 0 [pid 549] symlink("/dev/binderfs", "./binderfs" [pid 547] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [ 26.121902][ T536] [pid 543] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 533] exit_group(0 [pid 549] <... symlink resumed>) = 0 [pid 545] <... futex resumed>) = ? [pid 543] <... futex resumed>) = ? [pid 533] <... exit_group resumed>) = ? [pid 549] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 545] +++ exited with 0 +++ [pid 543] +++ exited with 0 +++ [pid 549] <... futex resumed>) = 0 [pid 549] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 549] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 549] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[550], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 550 [pid 549] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 549] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 549] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 549] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 549] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[551], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 551 [pid 549] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 549] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 535] +++ exited with 0 +++ ./strace-static-x86_64: Process 551 attached [pid 551] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 551] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 551] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 549] <... futex resumed>) = 0 [pid 549] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 549] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 551] <... futex resumed>) = 1 [pid 551] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 551] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 549] <... futex resumed>) = 0 [pid 549] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=535, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 549] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 551] <... futex resumed>) = 1 [pid 551] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 295] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 551] <... open resumed>) = 4 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 551] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 549] <... futex resumed>) = 0 [pid 295] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 550 attached [pid 551] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 549] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... openat resumed>) = 3 [pid 551] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 550] set_robust_list(0x7f35deb1e9e0, 24 [pid 549] <... futex resumed>) = 0 [pid 295] fstat(3, [pid 551] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] <... set_robust_list resumed>) = 0 [pid 549] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 551] <... futex resumed>) = 0 [pid 550] memfd_create("syzkaller", 0 [pid 549] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] getdents64(3, [pid 551] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 550] <... memfd_create resumed>) = 5 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 550] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 295] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 550] <... mmap resumed>) = 0x7f35d66dd000 [pid 295] <... umount2 resumed>) = 0 [pid 550] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 295] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./9/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] unlink("./9/bus") = 0 [pid 550] <... write resumed>) = 262144 [pid 550] munmap(0x7f35d66dd000, 262144) = 0 [pid 550] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 6 [ 26.160130][ T547] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 26.160130][ T547] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 26.160130][ T547] [pid 550] ioctl(6, LOOP_SET_FD, 5) = 0 [pid 550] close(5) = 0 [pid 550] mkdir("./file1", 0777) = 0 [pid 550] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 295] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./9/binderfs") = 0 [pid 295] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 532] <... write resumed>) = 16777216 [pid 295] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 532] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 532] <... futex resumed>) = 0 [pid 295] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 532] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] <... openat resumed>) = 4 [pid 295] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./9/file1") = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./9") = 0 [pid 295] mkdir("./10", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 552 [pid 528] exit_group(0 [pid 538] <... futex resumed>) = ? [pid 531] <... futex resumed>) = ? [pid 528] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 552 attached [pid 538] +++ exited with 0 +++ [pid 531] +++ exited with 0 +++ [pid 552] set_robust_list(0x555556c9c5e0, 24 [pid 532] <... futex resumed>) = ? [pid 552] <... set_robust_list resumed>) = 0 [pid 552] chdir("./10" [pid 533] +++ exited with 0 +++ [pid 532] +++ exited with 0 +++ [pid 528] +++ exited with 0 +++ [pid 552] <... chdir resumed>) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=533, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 552] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=528, si_uid=0, si_status=0, si_utime=0, si_stime=26} --- [pid 552] <... prctl resumed>) = 0 [ 26.203097][ T550] loop2: detected capacity change from 0 to 512 [ 26.214064][ T550] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 26.214064][ T550] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 26.214064][ T550] [ 26.234876][ T532] syz-executor252 (532) used greatest stack depth: 21776 bytes left [pid 552] setpgid(0, 0) = 0 [pid 299] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 552] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 552] <... openat resumed>) = 3 [pid 299] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 552] write(3, "1000", 4 [pid 299] <... openat resumed>) = 3 [pid 552] <... write resumed>) = 4 [pid 299] fstat(3, [pid 552] close(3 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 552] <... close resumed>) = 0 [pid 299] getdents64(3, [pid 552] symlink("/dev/binderfs", "./binderfs") = 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 552] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 552] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 552] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] <... umount2 resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 552] <... mmap resumed>) = 0x7f35deafe000 [pid 299] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] fstat(3, [pid 552] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 552] <... mprotect resumed>) = 0 [pid 299] lstat("./10/bus", [pid 296] getdents64(3, [pid 552] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] unlink("./10/bus" [pid 296] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 552] <... clone resumed>, parent_tid=[559], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 559 [pid 299] <... unlink resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 552] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] lstat("./8/bus", [pid 552] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=16777216, ...}) = 0 [pid 552] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] lstat("./10/binderfs", [pid 296] unlink("./8/bus" [pid 552] <... futex resumed>) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 552] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] unlink("./10/binderfs" [pid 552] <... mmap resumed>) = 0x7f35deadd000 [pid 299] <... unlink resumed>) = 0 [pid 552] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 299] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 552] <... mprotect resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 552] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 299] lstat("./10/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 552] <... clone resumed>, parent_tid=[560], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 560 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 552] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 552] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 4 [pid 552] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./10/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./10") = 0 [pid 299] mkdir("./11", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 561 [ 26.252143][ T536] EXT4-fs (loop5): 1 orphan inode deleted [ 26.294034][ T536] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 26.319454][ T550] EXT4-fs (loop2): 1 orphan inode deleted [ 26.325007][ T550] EXT4-fs (loop2): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 26.348481][ T547] EXT4-fs (loop3): 1 orphan inode deleted [ 26.353379][ T559] loop0: detected capacity change from 0 to 512 [ 26.354021][ T547] EXT4-fs (loop3): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 26.363650][ T536] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/9/file1 supports timestamps until 2038 (0x7fffffff) ./strace-static-x86_64: Process 561 attached ./strace-static-x86_64: Process 560 attached ./strace-static-x86_64: Process 559 attached [pid 552] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 561] set_robust_list(0x555556c9c5e0, 24 [pid 560] set_robust_list(0x7f35deafd9e0, 24 [pid 559] set_robust_list(0x7f35deb1e9e0, 24 [pid 552] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 561] <... set_robust_list resumed>) = 0 [pid 560] <... set_robust_list resumed>) = 0 [pid 559] <... set_robust_list resumed>) = 0 [pid 552] <... futex resumed>) = 0 [pid 561] chdir("./11" [pid 560] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 559] memfd_create("syzkaller", 0 [pid 552] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 561] <... chdir resumed>) = 0 [pid 560] <... open resumed>) = 4 [pid 559] <... memfd_create resumed>) = 3 [pid 552] <... mmap resumed>) = 0x7f35deabc000 [pid 561] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 560] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 552] mprotect(0x7f35deabd000, 131072, PROT_READ|PROT_WRITE [pid 561] <... prctl resumed>) = 0 [pid 560] <... futex resumed>) = 0 [pid 559] <... mmap resumed>) = 0x7f35d66bc000 [pid 552] <... mprotect resumed>) = 0 [pid 561] setpgid(0, 0 [pid 560] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 559] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 552] clone(child_stack=0x7f35deadc3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 561] <... setpgid resumed>) = 0 [pid 559] <... write resumed>) = 262144 [pid 561] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 559] munmap(0x7f35d66bc000, 262144 [pid 552] <... clone resumed>, parent_tid=[563], tls=0x7f35deadc700, child_tidptr=0x7f35deadc9d0) = 563 [pid 561] <... openat resumed>) = 3 [pid 559] <... munmap resumed>) = 0 [pid 552] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 561] write(3, "1000", 4 [pid 559] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 552] <... futex resumed>) = 0 [pid 561] <... write resumed>) = 4 [pid 559] <... openat resumed>) = 5 [pid 552] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 561] close(3 [pid 559] ioctl(5, LOOP_SET_FD, 3 [pid 561] <... close resumed>) = 0 [pid 561] symlink("/dev/binderfs", "./binderfs") = 0 [pid 561] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 561] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 561] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[564], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 564 [pid 561] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 561] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 561] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[565], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 565 [pid 561] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 559] <... ioctl resumed>) = 0 [pid 559] close(3) = 0 [pid 559] mkdir("./file1", 0777) = 0 [pid 559] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 536] <... mount resumed>) = 0 [pid 536] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 536] chdir("./file1") = 0 [pid 536] ioctl(5, LOOP_CLR_FD) = 0 [pid 536] close(5) = 0 [pid 536] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 536] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 552] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 552] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 552] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 552] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 552] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 552] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0}) = -1 ETIMEDOUT (Connection timed out) [pid 552] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 560] <... futex resumed>) = 0 [pid 552] <... futex resumed>) = 1 [pid 560] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 552] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 560] <... open resumed>) = 3 [pid 560] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 552] <... futex resumed>) = 0 [pid 560] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 552] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 561] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 552] <... futex resumed>) = 0 [pid 561] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 552] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 561] <... futex resumed>) = 0 [pid 561] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deabc000 [pid 561] mprotect(0x7f35deabd000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 561] clone(child_stack=0x7f35deadc3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[566], tls=0x7f35deadc700, child_tidptr=0x7f35deadc9d0) = 566 [pid 561] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 566 attached [pid 566] set_robust_list(0x7f35deadc9e0, 24) = 0 [pid 566] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = -1 ENOENT (No such file or directory) [pid 566] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 561] <... futex resumed>) = 0 [pid 561] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 566] <... futex resumed>) = 1 [pid 566] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = -1 ENOENT (No such file or directory) [pid 566] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 561] <... futex resumed>) = 0 [pid 561] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 561] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 566] <... futex resumed>) = 1 [pid 566] write(-1, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 EBADF (Bad file descriptor) [pid 566] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 561] <... futex resumed>) = 0 [pid 566] <... futex resumed>) = 1 [pid 566] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... unlink resumed>) = 0 [pid 296] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 550] <... mount resumed>) = 0 [pid 550] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 550] chdir("./file1") = 0 [pid 550] ioctl(6, LOOP_CLR_FD) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 550] close(6) = 0 [pid 550] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] lstat("./8/binderfs", [pid 549] exit_group(0 [pid 550] <... futex resumed>) = ? [pid 549] <... exit_group resumed>) = ? [pid 550] +++ exited with 0 +++ [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./8/binderfs") = 0 [pid 296] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 551] <... futex resumed>) = ? [pid 547] <... mount resumed>) = 0 [pid 551] +++ exited with 0 +++ [pid 549] +++ exited with 0 +++ ./strace-static-x86_64: Process 563 attached [pid 547] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY./strace-static-x86_64: Process 564 attached [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=549, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- ./strace-static-x86_64: Process 565 attached [pid 563] set_robust_list(0x7f35deadc9e0, 24 [pid 564] set_robust_list(0x7f35deb1e9e0, 24 [pid 547] <... openat resumed>) = 5 [pid 564] <... set_robust_list resumed>) = 0 [pid 563] <... set_robust_list resumed>) = 0 [pid 565] set_robust_list(0x7f35deafd9e0, 24 [pid 547] chdir("./file1" [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 565] <... set_robust_list resumed>) = 0 [pid 563] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 547] <... chdir resumed>) = 0 [pid 565] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 564] memfd_create("syzkaller", 0 [pid 547] ioctl(6, LOOP_CLR_FD [pid 565] <... open resumed>) = 3 [pid 564] <... memfd_create resumed>) = 4 [pid 565] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] <... ioctl resumed>) = 0 [pid 565] <... futex resumed>) = 0 [pid 564] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 547] close(6 [pid 297] <... restart_syscall resumed>) = 0 [pid 565] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 564] <... mmap resumed>) = 0x7f35d66bc000 [pid 547] <... close resumed>) = 0 [pid 297] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] exit_group(0 [pid 297] <... umount2 resumed>) = 0 [pid 548] <... futex resumed>) = ? [pid 546] <... exit_group resumed>) = ? [pid 297] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 548] +++ exited with 0 +++ [pid 564] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 547] <... futex resumed>) = 230 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./9/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] unlink("./9/bus" [pid 564] <... write resumed>) = 262144 [pid 297] <... unlink resumed>) = 0 [pid 297] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./9/binderfs" [pid 547] +++ exited with 0 +++ [pid 546] +++ exited with 0 +++ [pid 564] munmap(0x7f35d66bc000, 262144 [pid 297] <... unlink resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=546, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 297] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 564] <... munmap resumed>) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 564] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 298] <... restart_syscall resumed>) = 0 [pid 564] <... openat resumed>) = 5 [pid 564] ioctl(5, LOOP_SET_FD, 4 [pid 298] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [ 26.394792][ T559] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 26.394792][ T559] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 26.394792][ T559] [ 26.415072][ T550] ext4 filesystem being mounted at /root/syzkaller.7ngmbG/9/file1 supports timestamps until 2038 (0x7fffffff) [ 26.429126][ T547] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/10/file1 supports timestamps until 2038 (0x7fffffff) [pid 298] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 564] <... ioctl resumed>) = 0 [pid 552] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 298] <... umount2 resumed>) = 0 [pid 564] close(4 [pid 298] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 564] <... close resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 564] mkdir("./file1", 0777 [pid 298] lstat("./10/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] unlink("./10/bus" [pid 564] <... mkdir resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 564] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 298] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] unlink("./10/binderfs") = 0 [pid 298] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 297] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 26.448984][ T564] loop4: detected capacity change from 0 to 512 [ 26.468420][ T564] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 26.468420][ T564] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 26.468420][ T564] [pid 297] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./9/file1") = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./9") = 0 [pid 297] mkdir("./10", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 534] exit_group(0 [pid 541] <... futex resumed>) = ? [pid 536] <... futex resumed>) = ? [pid 534] <... exit_group resumed>) = ? [pid 541] +++ exited with 0 +++ [pid 536] +++ exited with 0 +++ [pid 297] <... openat resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 569 ./strace-static-x86_64: Process 569 attached [pid 569] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 569] chdir("./10" [pid 298] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 569] <... chdir resumed>) = 0 [pid 298] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 569] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 569] <... prctl resumed>) = 0 [pid 298] lstat("./10/file1", [pid 296] lstat("./8/file1", [pid 569] setpgid(0, 0 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 569] <... setpgid resumed>) = 0 [pid 298] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 569] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 569] <... openat resumed>) = 3 [pid 298] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... openat resumed>) = 4 [pid 569] write(3, "1000", 4 [pid 298] <... openat resumed>) = 4 [pid 296] fstat(4, [pid 569] <... write resumed>) = 4 [pid 298] fstat(4, [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 569] close(3 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(4, [pid 569] <... close resumed>) = 0 [pid 298] getdents64(4, [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 569] symlink("/dev/binderfs", "./binderfs" [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 569] <... symlink resumed>) = 0 [pid 298] getdents64(4, [pid 296] close(4 [pid 569] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] <... close resumed>) = 0 [pid 569] <... futex resumed>) = 0 [pid 298] close(4 [pid 296] rmdir("./8/file1" [pid 569] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... close resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 569] <... mmap resumed>) = 0x7f35deafe000 [pid 298] rmdir("./10/file1" [pid 296] getdents64(3, [pid 569] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 569] <... mprotect resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 296] close(3 [pid 569] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] getdents64(3, [pid 296] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] rmdir("./8" [pid 569] <... clone resumed>, parent_tid=[571], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 571 [pid 298] close(3 [pid 296] <... rmdir resumed>) = 0 [pid 569] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 296] mkdir("./9", 0777 [pid 569] <... futex resumed>) = 0 [pid 298] rmdir("./10" [pid 296] <... mkdir resumed>) = 0 [pid 569] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 569] <... futex resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 569] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] mkdir("./11", 0777 [pid 296] ioctl(3, LOOP_CLR_FD [pid 569] <... mmap resumed>) = 0x7f35deadd000 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 569] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 298] <... mkdir resumed>) = 0 [pid 296] close(3 [pid 569] <... mprotect resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] <... close resumed>) = 0 [pid 569] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] <... openat resumed>) = 3 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] ioctl(3, LOOP_CLR_FD [pid 569] <... clone resumed>, parent_tid=[572], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 572 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 573 [pid 569] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 569] <... futex resumed>) = 0 [pid 569] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... close resumed>) = 0 [ 26.501925][ T559] EXT4-fs (loop0): 1 orphan inode deleted [ 26.522233][ T559] EXT4-fs (loop0): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 573 attached [pid 573] set_robust_list(0x555556c9c5e0, 24 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 574 [pid 573] <... set_robust_list resumed>) = 0 [pid 573] chdir("./9" [pid 537] <... write resumed>) = ? [pid 573] <... chdir resumed>) = 0 [pid 537] +++ exited with 0 +++ [pid 534] +++ exited with 0 +++ [pid 573] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=534, si_uid=0, si_status=0, si_utime=0, si_stime=29} --- [pid 573] <... prctl resumed>) = 0 [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 573] setpgid(0, 0./strace-static-x86_64: Process 571 attached ) = 0 [pid 300] <... restart_syscall resumed>) = 0 [pid 573] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 573] write(3, "1000", 4 [pid 300] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 573] <... write resumed>) = 4 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 573] close(3 [pid 300] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 573] <... close resumed>) = 0 [pid 300] <... openat resumed>) = 3 [pid 573] symlink("/dev/binderfs", "./binderfs" [pid 300] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 573] <... symlink resumed>) = 0 [pid 571] set_robust_list(0x7f35deb1e9e0, 24 [pid 300] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 573] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = 0 [pid 573] <... futex resumed>) = 0 [pid 300] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 573] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 574 attached [pid 573] <... mmap resumed>) = 0x7f35deafe000 [pid 571] <... set_robust_list resumed>) = 0 [pid 300] lstat("./9/bus", [pid 573] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=16777216, ...}) = 0 [pid 573] <... mprotect resumed>) = 0 [pid 300] unlink("./9/bus" [pid 573] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 571] memfd_create("syzkaller", 0 [pid 573] <... clone resumed>, parent_tid=[576], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 576 [pid 571] <... memfd_create resumed>) = 3 [pid 573] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 571] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 573] <... futex resumed>) = 0 [pid 571] <... mmap resumed>) = 0x7f35d66dd000 ./strace-static-x86_64: Process 572 attached [pid 574] set_robust_list(0x555556c9c5e0, 24 [pid 573] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 571] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 573] <... futex resumed>) = 0 [pid 573] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 573] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 574] <... set_robust_list resumed>) = 0 [pid 573] <... mprotect resumed>) = 0 [pid 572] set_robust_list(0x7f35deafd9e0, 24 [pid 571] <... write resumed>) = 262144 [pid 574] chdir("./11" [pid 573] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 574] <... chdir resumed>) = 0 [pid 574] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 573] <... clone resumed>, parent_tid=[577], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 577 [pid 574] <... prctl resumed>) = 0 [pid 573] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] setpgid(0, 0 [pid 573] <... futex resumed>) = 0 [pid 574] <... setpgid resumed>) = 0 [pid 574] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 573] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 572] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 576 attached [pid 574] <... openat resumed>) = 3 [pid 572] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 571] munmap(0x7f35d66dd000, 262144./strace-static-x86_64: Process 577 attached [pid 576] set_robust_list(0x7f35deb1e9e0, 24 [pid 574] write(3, "1000", 4 [pid 572] <... open resumed>) = 4 [pid 571] <... munmap resumed>) = 0 [pid 569] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 577] set_robust_list(0x7f35deafd9e0, 24 [pid 576] <... set_robust_list resumed>) = 0 [pid 574] <... write resumed>) = 4 [pid 572] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 571] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 563] <... mount resumed>) = 0 [pid 576] memfd_create("syzkaller", 0 [pid 574] close(3 [pid 572] <... futex resumed>) = 0 [pid 571] <... openat resumed>) = 5 [pid 576] <... memfd_create resumed>) = 3 [pid 574] <... close resumed>) = 0 [pid 572] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 571] ioctl(5, LOOP_SET_FD, 3 [pid 577] <... set_robust_list resumed>) = 0 [pid 576] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 574] symlink("/dev/binderfs", "./binderfs" [pid 569] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 563] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 572] <... futex resumed>) = 0 [pid 569] <... futex resumed>) = 1 [pid 563] <... futex resumed>) = 0 [pid 577] <... open resumed>) = 4 [pid 572] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 569] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 563] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 577] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 572] <... mount resumed>) = 0 [pid 577] <... futex resumed>) = 1 [pid 573] <... futex resumed>) = 0 [pid 572] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 573] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 572] <... futex resumed>) = 1 [pid 569] <... futex resumed>) = 0 [pid 577] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 573] <... futex resumed>) = 0 [pid 572] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 573] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 572] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 569] <... futex resumed>) = 0 [pid 577] <... mount resumed>) = 0 [pid 572] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 569] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 577] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] <... symlink resumed>) = 0 [pid 577] <... futex resumed>) = 1 [pid 574] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 573] <... futex resumed>) = 0 [pid 577] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 574] <... futex resumed>) = 0 [pid 573] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 576] <... mmap resumed>) = 0x7f35d66dd000 [pid 574] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 573] <... futex resumed>) = 0 [pid 577] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 574] <... mmap resumed>) = 0x7f35deafe000 [pid 573] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 577] <... open resumed>) = 5 [pid 574] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 577] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] <... mprotect resumed>) = 0 [pid 577] <... futex resumed>) = 1 [pid 573] <... futex resumed>) = 0 [pid 577] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 574] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 573] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 573] <... futex resumed>) = 0 [pid 577] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 576] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 574] <... clone resumed>, parent_tid=[578], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 578 [pid 573] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 577] <... write resumed>) = -1 ENOSPC (No space left on device) [ 26.625955][ T564] EXT4-fs (loop4): 1 orphan inode deleted [ 26.633018][ T564] EXT4-fs (loop4): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 26.654912][ T559] ext4 filesystem being mounted at /root/syzkaller.d28Auw/10/file1 supports timestamps until 2038 (0x7fffffff) [ 26.666923][ T571] loop2: detected capacity change from 0 to 512 [pid 574] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] <... write resumed>) = 262144 [pid 574] <... futex resumed>) = 0 [pid 572] <... open resumed>) = 6 [pid 571] <... ioctl resumed>) = 0 [pid 559] <... mount resumed>) = 0 ./strace-static-x86_64: Process 578 attached [pid 577] <... futex resumed>) = 1 [pid 576] munmap(0x7f35d66dd000, 262144 [pid 574] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 573] <... futex resumed>) = 0 [pid 572] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 571] close(3 [pid 559] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 578] set_robust_list(0x7f35deb1e9e0, 24 [pid 577] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 576] <... munmap resumed>) = 0 [pid 574] <... futex resumed>) = 0 [pid 572] <... futex resumed>) = 1 [pid 571] <... close resumed>) = 0 [pid 569] <... futex resumed>) = 0 [pid 559] <... openat resumed>) = 6 [pid 578] <... set_robust_list resumed>) = 0 [pid 576] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 574] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 572] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 571] mkdir("./file1", 0777 [pid 569] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 560] <... write resumed>) = 16777216 [pid 559] chdir("./file1" [pid 578] memfd_create("syzkaller", 0 [pid 576] <... openat resumed>) = 6 [pid 574] <... mmap resumed>) = 0x7f35deadd000 [pid 572] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 571] <... mkdir resumed>) = 0 [pid 569] <... futex resumed>) = 0 [pid 560] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] <... chdir resumed>) = 0 [pid 578] <... memfd_create resumed>) = 3 [pid 576] ioctl(6, LOOP_SET_FD, 3 [pid 574] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 572] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 571] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 569] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 560] <... futex resumed>) = 0 [pid 559] ioctl(5, LOOP_CLR_FD [pid 578] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 572] <... write resumed>) = 262144 [pid 560] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 572] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 569] <... futex resumed>) = 0 [pid 572] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 564] <... mount resumed>) = 0 [pid 564] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 564] chdir("./file1") = 0 [pid 564] ioctl(5, LOOP_CLR_FD [pid 578] <... mmap resumed>) = 0x7f35d66dd000 [pid 574] <... mprotect resumed>) = 0 [pid 559] <... ioctl resumed>) = 0 [pid 578] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 576] <... ioctl resumed>) = 0 [pid 574] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 559] close(5 [pid 564] <... ioctl resumed>) = 0 [pid 578] <... write resumed>) = 262144 [pid 564] close(5 [pid 559] <... close resumed>) = 0 [pid 578] munmap(0x7f35d66dd000, 262144 [pid 576] close(3 [pid 574] <... clone resumed>, parent_tid=[579], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 579 [pid 559] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 578] <... munmap resumed>) = 0 [pid 576] <... close resumed>) = 0 [pid 574] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] <... futex resumed>) = 0 [pid 578] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 576] mkdir("./file1", 0777 [pid 574] <... futex resumed>) = 0 [pid 559] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 578] <... openat resumed>) = 4 [pid 552] exit_group(0 [pid 578] ioctl(4, LOOP_SET_FD, 3 [pid 576] <... mkdir resumed>) = 0 [pid 574] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 563] <... futex resumed>) = ? [pid 560] <... futex resumed>) = ? [pid 559] <... futex resumed>) = ? [pid 552] <... exit_group resumed>) = ? [pid 563] +++ exited with 0 +++ [pid 560] +++ exited with 0 +++ [pid 559] +++ exited with 0 +++ [pid 552] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=552, si_uid=0, si_status=0, si_utime=0, si_stime=22} --- [pid 295] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 295] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, [ 26.684204][ T564] ext4 filesystem being mounted at /root/syzkaller.RJEgPO/11/file1 supports timestamps until 2038 (0x7fffffff) [ 26.700596][ T576] loop1: detected capacity change from 0 to 512 [ 26.708631][ T571] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [ 26.723949][ T578] loop3: detected capacity change from 0 to 512 [pid 576] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 ./strace-static-x86_64: Process 579 attached [pid 578] <... ioctl resumed>) = 0 [pid 571] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 564] <... close resumed>) = 0 [pid 300] <... unlink resumed>) = 0 [pid 578] close(3 [pid 300] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 578] <... close resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 578] mkdir("./file1", 0777 [pid 300] lstat("./9/binderfs", [pid 578] <... mkdir resumed>) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 578] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 300] unlink("./9/binderfs") = 0 [pid 300] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 571] ioctl(5, LOOP_CLR_FD) = 0 [pid 571] close(5) = 0 [pid 571] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 571] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 579] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 564] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 579] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 564] <... futex resumed>) = 0 [pid 579] <... open resumed>) = 3 [pid 564] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 579] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] <... futex resumed>) = 0 [pid 574] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 574] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 579] <... futex resumed>) = 1 [pid 579] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 579] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] <... futex resumed>) = 0 [pid 574] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 574] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 579] <... futex resumed>) = 1 [pid 579] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 579] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] <... futex resumed>) = 0 [pid 574] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 574] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 579] <... futex resumed>) = 1 [pid 579] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 295] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 561] exit_group(0 [pid 564] <... futex resumed>) = ? [pid 561] <... exit_group resumed>) = ? [pid 564] +++ exited with 0 +++ [pid 566] <... futex resumed>) = ? [pid 565] <... futex resumed>) = ? [pid 566] +++ exited with 0 +++ [pid 565] +++ exited with 0 +++ [pid 561] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=561, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 299] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./11/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] unlink("./11/bus") = 0 [pid 299] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./11/binderfs") = 0 [pid 299] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 569] exit_group(0 [pid 572] <... futex resumed>) = ? [pid 571] <... futex resumed>) = ? [pid 569] <... exit_group resumed>) = ? [pid 579] <... write resumed>) = 262144 [pid 572] +++ exited with 0 +++ [pid 571] +++ exited with 0 +++ [pid 295] <... umount2 resumed>) = 0 [pid 579] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] <... futex resumed>) = 0 [pid 579] <... futex resumed>) = 1 [pid 295] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 579] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] lstat("./10/bus", {st_mode=S_IFREG|000, st_size=16777216, ...}) = 0 [ 26.731326][ T576] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 26.731326][ T576] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 26.731326][ T576] [ 26.746670][ T578] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 26.746670][ T578] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 26.746670][ T578] [pid 295] unlink("./10/bus" [pid 299] <... umount2 resumed>) = 0 [pid 299] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./11/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 299] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./11/file1" [pid 578] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 578] ioctl(4, LOOP_CLR_FD) = 0 [pid 578] close(4 [pid 569] +++ exited with 0 +++ [pid 300] <... umount2 resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 300] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] getdents64(3, [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=569, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3 [pid 300] lstat("./9/file1", [pid 299] <... close resumed>) = 0 [pid 297] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] rmdir("./11" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 26.776028][ T578] EXT4-fs (loop3): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 26.786172][ T578] EXT4-fs (loop3): group descriptors corrupted! [ 26.807558][ T576] EXT4-fs (loop1): 1 orphan inode deleted [pid 578] <... close resumed>) = 0 [pid 300] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... rmdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... unlink resumed>) = 0 [pid 299] mkdir("./12", 0777 [pid 297] <... openat resumed>) = 3 [pid 299] <... mkdir resumed>) = 0 [pid 297] fstat(3, [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... openat resumed>) = 3 [pid 297] getdents64(3, [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 582 [pid 295] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 578] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 578] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./10/binderfs") = 0 [pid 574] exit_group(0 [pid 579] <... futex resumed>) = ? [pid 574] <... exit_group resumed>) = ? [pid 579] +++ exited with 0 +++ [pid 578] <... futex resumed>) = ? [pid 578] +++ exited with 0 +++ [pid 574] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=574, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 295] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... restart_syscall resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 298] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] lstat("./10/bus", [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... openat resumed>) = 3 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] fstat(3, [pid 297] unlink("./10/bus" [pid 300] <... openat resumed>) = 4 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... unlink resumed>) = 0 [pid 298] getdents64(3, [pid 297] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] fstat(4, [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] getdents64(4, [pid 297] unlink("./10/binderfs" [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] <... unlink resumed>) = 0 [pid 297] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./10/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] getdents64(4, [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./10/file1") = 0 [pid 297] getdents64(3, [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] close(4 [pid 297] close(3 [pid 300] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 300] rmdir("./9/file1" [pid 297] rmdir("./10" [pid 300] <... rmdir resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 297] mkdir("./11", 0777 [pid 300] getdents64(3, [pid 297] <... mkdir resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 300] close(3 [pid 297] <... openat resumed>) = 3 [pid 300] <... close resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 300] rmdir("./9" [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] <... rmdir resumed>) = 0 [pid 300] mkdir("./10", 0777 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 583 [pid 300] <... mkdir resumed>) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] <... umount2 resumed>) = 0 [pid 298] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] <... openat resumed>) = 3 [pid 298] lstat("./11/bus", [pid 300] ioctl(3, LOOP_CLR_FD [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] unlink("./11/bus" [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] close(3 [pid 298] unlink("./11/binderfs" [pid 300] <... close resumed>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./11/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 584 [pid 298] <... openat resumed>) = 4 [pid 298] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./11/file1") = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./11") = 0 [pid 298] mkdir("./12", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 576] <... mount resumed>) = 0 [pid 576] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 576] chdir("./file1") = 0 [pid 576] ioctl(6, LOOP_CLR_FD) = 0 [pid 576] close(6) = 0 [pid 576] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 573] exit_group(0 [pid 577] <... futex resumed>) = 231 [pid 573] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 582 attached [pid 577] +++ exited with 0 +++ [pid 582] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 582] chdir("./12") = 0 [pid 582] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 582] setpgid(0, 0) = 0 [pid 582] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 582] write(3, "1000", 4) = 4 [pid 582] close(3) = 0 [pid 582] symlink("/dev/binderfs", "./binderfs") = 0 [pid 582] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 582] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 ./strace-static-x86_64: Process 584 attached [pid 576] <... futex resumed>) = ? [pid 582] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[585], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 585 [pid 576] +++ exited with 0 +++ [pid 573] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=573, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 582] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] set_robust_list(0x555556c9c5e0, 24 [pid 582] <... futex resumed>) = 0 [pid 582] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 582] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 582] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] <... restart_syscall resumed>) = 0 [pid 584] <... set_robust_list resumed>) = 0 [pid 296] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 296] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./9/bus", [pid 584] chdir("./10" [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] unlink("./9/bus") = 0 [pid 296] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./9/binderfs", [pid 584] <... chdir resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./9/binderfs" [pid 584] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] <... unlink resumed>) = 0 [pid 584] <... prctl resumed>) = 0 [pid 584] setpgid(0, 0 [pid 296] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 584] <... setpgid resumed>) = 0 [pid 584] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 582] <... clone resumed>, parent_tid=[586], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 586 [pid 582] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 586 attached [pid 586] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 586] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 584] <... openat resumed>) = 3 [pid 586] <... open resumed>) = 3 [pid 586] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 582] <... futex resumed>) = 0 [pid 582] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] write(3, "1000", 4 [pid 582] <... futex resumed>) = 0 [pid 582] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 586] <... futex resumed>) = 1 [pid 586] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 586] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 582] <... futex resumed>) = 0 [pid 582] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 586] <... futex resumed>) = 1 [pid 586] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 586] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 582] <... futex resumed>) = 0 [pid 582] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 584] <... write resumed>) = 4 [pid 584] close(3 [pid 586] <... futex resumed>) = 1 [pid 584] <... close resumed>) = 0 [pid 586] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 586] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] symlink("/dev/binderfs", "./binderfs" [pid 582] <... futex resumed>) = 0 [pid 586] <... futex resumed>) = 1 [pid 586] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 584] <... symlink resumed>) = 0 [pid 584] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 584] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 584] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 584] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 583 attached , parent_tid=[587], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 587 ./strace-static-x86_64: Process 587 attached [pid 587] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 584] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 584] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 583] set_robust_list(0x555556c9c5e0, 24 [pid 584] <... futex resumed>) = 0 [pid 584] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 583] <... set_robust_list resumed>) = 0 [pid 584] <... mmap resumed>) = 0x7f35deadd000 [pid 584] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 583] chdir("./11" [pid 584] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 587] memfd_create("syzkaller", 0 [pid 583] <... chdir resumed>) = 0 [pid 584] <... clone resumed>, parent_tid=[588], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 588 [pid 584] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 583] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 584] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 583] <... prctl resumed>) = 0 [pid 583] setpgid(0, 0) = 0 [pid 587] <... memfd_create resumed>) = 3 [pid 587] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 583] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 587] <... mmap resumed>) = 0x7f35d66dd000 [pid 583] <... openat resumed>) = 3 [pid 583] write(3, "1000", 4) = 4 [pid 583] close(3) = 0 [pid 583] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 585 attached ) = 0 [pid 583] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 583] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 ./strace-static-x86_64: Process 588 attached [pid 583] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 585] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 583] <... mprotect resumed>) = 0 [pid 588] set_robust_list(0x7f35deafd9e0, 24 [pid 585] memfd_create("syzkaller", 0 [pid 583] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[589], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 589 [pid 583] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 589 attached ) = 0 [pid 589] set_robust_list(0x7f35deb1e9e0, 24 [pid 588] <... set_robust_list resumed>) = 0 [pid 585] <... memfd_create resumed>) = 5 [pid 583] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 585] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 583] <... futex resumed>) = 0 [pid 589] <... set_robust_list resumed>) = 0 [pid 585] <... mmap resumed>) = 0x7f35d66dd000 [pid 583] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 589] memfd_create("syzkaller", 0 [pid 583] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 589] <... memfd_create resumed>) = 3 [pid 589] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 583] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[590], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 590 [pid 583] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 583] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 585] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 588] <... open resumed>) = 4 [pid 588] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 587] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 588] <... futex resumed>) = 1 [pid 584] <... futex resumed>) = 0 [pid 584] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 584] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 588] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 589] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 585] <... write resumed>) = 262144 [pid 588] <... mount resumed>) = 0 [pid 588] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 590 attached [pid 590] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 590] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 587] <... write resumed>) = 262144 [pid 584] <... futex resumed>) = 0 [pid 588] <... futex resumed>) = 1 [pid 587] munmap(0x7f35d66dd000, 262144 [pid 585] munmap(0x7f35d66dd000, 262144 [ 26.813143][ T576] EXT4-fs (loop1): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 26.842676][ T576] ext4 filesystem being mounted at /root/syzkaller.5s3MMz/9/file1 supports timestamps until 2038 (0x7fffffff) [pid 584] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] <... open resumed>) = 4 [pid 584] <... futex resumed>) = 0 [pid 589] <... write resumed>) = 262144 [pid 588] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 587] <... munmap resumed>) = 0 [pid 585] <... munmap resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 296] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 584] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 588] <... open resumed>) = 5 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./9/file1", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] lstat("./10/file1", [pid 296] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... openat resumed>) = 4 [pid 295] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] fstat(4, [pid 295] <... openat resumed>) = 4 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] fstat(4, [pid 296] getdents64(4, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 591 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, [pid 296] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] close(4 [pid 295] getdents64(4, [pid 296] <... close resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] rmdir("./9/file1" [pid 588] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] close(4 [pid 589] munmap(0x7f35d66dd000, 262144 [pid 588] <... futex resumed>) = 1 [pid 587] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 585] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 584] <... futex resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 584] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 296] getdents64(3, [pid 295] rmdir("./10/file1" [pid 584] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 589] <... munmap resumed>) = 0 [pid 588] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 587] <... openat resumed>) = 6 [pid 585] <... openat resumed>) = 6 [pid 584] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] close(3 [pid 295] <... rmdir resumed>) = 0 [pid 588] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] <... close resumed>) = 0 [pid 295] getdents64(3, [pid 588] <... futex resumed>) = 0 [pid 296] rmdir("./9" [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 591 attached [pid 590] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 589] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 588] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 587] ioctl(6, LOOP_SET_FD, 3 [pid 585] ioctl(6, LOOP_SET_FD, 5 [pid 296] <... rmdir resumed>) = 0 [pid 295] close(3 [pid 296] mkdir("./10", 0777 [pid 295] <... close resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] rmdir("./10" [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 591] set_robust_list(0x555556c9c5e0, 24 [pid 590] <... futex resumed>) = 1 [pid 589] <... openat resumed>) = 5 [pid 583] <... futex resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] <... rmdir resumed>) = 0 [pid 583] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 591] <... set_robust_list resumed>) = 0 [pid 583] <... futex resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] mkdir("./11", 0777 [pid 591] chdir("./12") = 0 [pid 591] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 591] setpgid(0, 0) = 0 [pid 591] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 591] write(3, "1000", 4) = 4 [pid 591] close(3) = 0 [pid 591] symlink("/dev/binderfs", "./binderfs") = 0 [pid 591] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 591] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 591] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 591] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 583] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... mkdir resumed>) = 0 [pid 590] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 589] ioctl(5, LOOP_SET_FD, 3 [pid 587] <... ioctl resumed>) = 0 [pid 585] <... ioctl resumed>) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 590] <... mount resumed>) = 0 ./strace-static-x86_64: Process 592 attached [pid 592] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 592] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 587] close(3) = 0 [pid 587] mkdir("./file1", 0777) = 0 [pid 587] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 591] <... clone resumed>, parent_tid=[592], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 592 [pid 590] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 589] <... ioctl resumed>) = 0 [pid 585] close(5 [pid 296] close(3 [pid 295] <... openat resumed>) = 3 [pid 590] <... futex resumed>) = 1 [pid 583] <... futex resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 590] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 583] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 590] <... open resumed>) = 6 [pid 583] <... futex resumed>) = 0 [pid 295] close(3 [pid 590] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 583] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 593 [pid 295] <... close resumed>) = 0 [pid 590] <... futex resumed>) = 0 [pid 583] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 590] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 583] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 594 [pid 583] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 590] <... write resumed>) = 262144 [pid 590] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 583] <... futex resumed>) = 0 [pid 590] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 585] <... close resumed>) = 0 [pid 585] mkdir("./file1", 0777 [pid 591] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 591] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 591] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 591] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 591] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 585] <... mkdir resumed>) = 0 [pid 585] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 591] <... clone resumed>, parent_tid=[595], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 595 [pid 591] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 591] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 589] close(3) = 0 [ 26.907899][ T587] loop5: detected capacity change from 0 to 512 [ 26.914096][ T585] loop4: detected capacity change from 0 to 512 [ 26.920870][ T589] loop2: detected capacity change from 0 to 512 [ 26.923372][ T587] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 26.923372][ T587] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 26.923372][ T587] [ 26.936866][ T585] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [pid 589] mkdir("./file1", 0777./strace-static-x86_64: Process 595 attached ./strace-static-x86_64: Process 594 attached ./strace-static-x86_64: Process 593 attached [pid 592] <... futex resumed>) = 0 [pid 589] <... mkdir resumed>) = 0 [pid 595] set_robust_list(0x7f35deafd9e0, 24 [pid 594] set_robust_list(0x555556c9c5e0, 24 [pid 593] set_robust_list(0x555556c9c5e0, 24 [pid 589] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 595] <... set_robust_list resumed>) = 0 [pid 594] <... set_robust_list resumed>) = 0 [pid 593] <... set_robust_list resumed>) = 0 [pid 592] memfd_create("syzkaller", 0 [pid 595] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 594] chdir("./11" [pid 593] chdir("./10" [pid 592] <... memfd_create resumed>) = 3 [pid 595] <... open resumed>) = 4 [pid 594] <... chdir resumed>) = 0 [pid 593] <... chdir resumed>) = 0 [pid 592] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 595] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 593] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 592] <... mmap resumed>) = 0x7f35d66dd000 [pid 595] <... futex resumed>) = 1 [pid 594] <... prctl resumed>) = 0 [pid 593] <... prctl resumed>) = 0 [pid 592] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 595] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 594] setpgid(0, 0 [pid 593] setpgid(0, 0 [pid 591] <... futex resumed>) = 0 [pid 589] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 594] <... setpgid resumed>) = 0 [pid 593] <... setpgid resumed>) = 0 [pid 592] <... write resumed>) = 262144 [pid 591] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 595] <... futex resumed>) = 0 [pid 591] <... futex resumed>) = 1 [pid 589] ioctl(5, LOOP_CLR_FD [pid 595] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 591] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 595] <... mount resumed>) = 0 [pid 594] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 595] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 591] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 595] <... futex resumed>) = 0 [pid 593] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 595] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 591] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 595] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 594] <... openat resumed>) = 3 [pid 595] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 593] <... openat resumed>) = 3 [pid 594] write(3, "1000", 4 [pid 592] munmap(0x7f35d66dd000, 262144 [pid 591] <... futex resumed>) = 0 [pid 595] <... open resumed>) = 5 [pid 595] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 591] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 595] <... futex resumed>) = 0 [pid 591] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 595] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 591] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 595] <... futex resumed>) = 0 [pid 591] <... futex resumed>) = 1 [pid 595] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 591] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 595] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 594] <... write resumed>) = 4 [pid 593] write(3, "1000", 4 [pid 592] <... munmap resumed>) = 0 [pid 595] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... write resumed>) = 4 [pid 594] close(3 [pid 595] <... futex resumed>) = 1 [pid 593] close(3 [pid 592] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 591] <... futex resumed>) = 0 [pid 595] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 594] <... close resumed>) = 0 [pid 593] <... close resumed>) = 0 [pid 592] <... openat resumed>) = 6 [pid 594] symlink("/dev/binderfs", "./binderfs") = 0 [pid 593] symlink("/dev/binderfs", "./binderfs" [pid 592] ioctl(6, LOOP_SET_FD, 3 [pid 589] <... ioctl resumed>) = 0 [pid 594] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... symlink resumed>) = 0 [pid 594] <... futex resumed>) = 0 [pid 593] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 589] close(5 [pid 594] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 593] <... futex resumed>) = 0 [pid 589] <... close resumed>) = 0 [pid 594] <... mmap resumed>) = 0x7f35deafe000 [pid 593] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 589] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 593] <... mmap resumed>) = 0x7f35deafe000 [pid 589] <... futex resumed>) = 0 [pid 594] <... mprotect resumed>) = 0 [pid 593] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 594] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 593] <... mprotect resumed>) = 0 [pid 589] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 593] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 594] <... clone resumed>, parent_tid=[600], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 600 [pid 594] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... clone resumed>, parent_tid=[601], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 601 [pid 594] <... futex resumed>) = 0 [pid 593] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... futex resumed>) = 0 [pid 594] <... futex resumed>) = 0 [pid 593] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 593] <... futex resumed>) = 0 [pid 594] <... mmap resumed>) = 0x7f35deadd000 [pid 593] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 594] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 593] <... mmap resumed>) = 0x7f35deadd000 [pid 594] <... mprotect resumed>) = 0 [pid 593] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 594] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 593] <... mprotect resumed>) = 0 [pid 593] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 594] <... clone resumed>, parent_tid=[602], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 602 [pid 594] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... clone resumed>, parent_tid=[603], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 603 [pid 594] <... futex resumed>) = 0 [pid 593] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 593] <... futex resumed>) = 0 [pid 593] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 592] <... ioctl resumed>) = 0 [pid 592] close(3) = 0 [pid 592] mkdir("./file1", 0777) = 0 [pid 592] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 583] exit_group(0 [pid 589] <... futex resumed>) = ? [pid 583] <... exit_group resumed>) = ? [pid 589] +++ exited with 0 +++ [ 26.936866][ T585] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 26.936866][ T585] [ 26.965985][ T589] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [ 26.977788][ T585] EXT4-fs (loop4): 1 orphan inode deleted [ 26.978258][ T592] loop3: detected capacity change from 0 to 512 ./strace-static-x86_64: Process 603 attached ./strace-static-x86_64: Process 602 attached ./strace-static-x86_64: Process 601 attached ./strace-static-x86_64: Process 600 attached [pid 590] <... futex resumed>) = ? [pid 603] set_robust_list(0x7f35deafd9e0, 24 [pid 602] set_robust_list(0x7f35deafd9e0, 24 [pid 601] set_robust_list(0x7f35deb1e9e0, 24 [pid 600] set_robust_list(0x7f35deb1e9e0, 24 [pid 603] <... set_robust_list resumed>) = 0 [pid 602] <... set_robust_list resumed>) = 0 [pid 601] <... set_robust_list resumed>) = 0 [pid 600] <... set_robust_list resumed>) = 0 [ 26.983335][ T585] EXT4-fs (loop4): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 27.012478][ T587] EXT4-fs (loop5): 1 orphan inode deleted [ 27.013105][ T592] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 27.013105][ T592] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.013105][ T592] [ 27.036617][ T585] ext4 filesystem being mounted at /root/syzkaller.RJEgPO/12/file1 supports timestamps until 2038 (0x7fffffff) [pid 603] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 602] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 601] memfd_create("syzkaller", 0 [pid 600] memfd_create("syzkaller", 0 [pid 585] <... mount resumed>) = 0 [pid 603] <... open resumed>) = 3 [pid 602] <... open resumed>) = 3 [pid 601] <... memfd_create resumed>) = 4 [pid 600] <... memfd_create resumed>) = 4 [pid 603] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 600] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 603] <... futex resumed>) = 1 [pid 602] <... futex resumed>) = 1 [pid 601] <... mmap resumed>) = 0x7f35d66dd000 [pid 600] <... mmap resumed>) = 0x7f35d66dd000 [pid 594] <... futex resumed>) = 0 [pid 593] <... futex resumed>) = 0 [pid 603] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 602] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 601] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 600] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 594] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] <... mount resumed>) = 0 [pid 602] <... mount resumed>) = 0 [pid 594] <... futex resumed>) = 0 [pid 593] <... futex resumed>) = 0 [pid 603] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 593] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 603] <... futex resumed>) = 0 [pid 602] <... futex resumed>) = 0 [pid 594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 593] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 603] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 602] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 594] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] <... open resumed>) = 5 [pid 602] <... open resumed>) = 5 [pid 594] <... futex resumed>) = 0 [pid 593] <... futex resumed>) = 0 [pid 603] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] <... write resumed>) = 262144 [pid 600] <... write resumed>) = 262144 [pid 594] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 593] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 603] <... futex resumed>) = 0 [pid 602] <... futex resumed>) = 0 [pid 594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 593] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 603] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 602] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 594] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 602] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 601] munmap(0x7f35d66dd000, 262144 [pid 600] munmap(0x7f35d66dd000, 262144 [pid 594] <... futex resumed>) = 0 [pid 593] <... futex resumed>) = 0 [pid 603] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] <... munmap resumed>) = 0 [pid 600] <... munmap resumed>) = 0 [pid 594] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 593] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 603] <... futex resumed>) = 0 [pid 602] <... futex resumed>) = 0 [pid 601] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 600] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 593] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 603] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 602] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 601] <... openat resumed>) = 6 [pid 600] <... openat resumed>) = 6 [pid 601] ioctl(6, LOOP_SET_FD, 4 [pid 600] ioctl(6, LOOP_SET_FD, 4) = 0 [pid 587] <... mount resumed>) = 0 [pid 585] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 600] close(4 [pid 587] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 585] <... openat resumed>) = 5 [pid 600] <... close resumed>) = 0 [pid 587] <... openat resumed>) = 3 [pid 585] chdir("./file1" [pid 600] mkdir("./file1", 0777 [pid 587] chdir("./file1" [pid 585] <... chdir resumed>) = 0 [pid 600] <... mkdir resumed>) = 0 [pid 587] <... chdir resumed>) = 0 [pid 585] ioctl(6, LOOP_CLR_FD [pid 600] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [ 27.037585][ T587] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 27.059174][ T600] loop0: detected capacity change from 0 to 512 [ 27.071365][ T587] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/10/file1 supports timestamps until 2038 (0x7fffffff) [ 27.077389][ T601] loop1: detected capacity change from 0 to 512 [ 27.093858][ T600] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [pid 587] ioctl(6, LOOP_CLR_FD [pid 585] <... ioctl resumed>) = 0 [pid 601] <... ioctl resumed>) = 0 [pid 587] <... ioctl resumed>) = 0 [pid 601] close(4) = 0 [pid 601] mkdir("./file1", 0777) = 0 [pid 590] +++ exited with 0 +++ [pid 583] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=583, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 297] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 601] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 587] close(6 [pid 585] close(6 [pid 297] <... umount2 resumed>) = 0 [pid 587] <... close resumed>) = 0 [pid 585] <... close resumed>) = 0 [pid 297] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 587] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 585] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 587] <... futex resumed>) = 0 [pid 585] <... futex resumed>) = 0 [pid 297] lstat("./11/bus", [pid 587] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 585] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] unlink("./11/bus") = 0 [pid 297] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./11/binderfs" [pid 584] exit_group(0 [pid 582] exit_group(0 [pid 297] <... unlink resumed>) = 0 [pid 588] <... futex resumed>) = ? [pid 586] <... futex resumed>) = ? [pid 585] <... futex resumed>) = ? [pid 587] <... futex resumed>) = ? [pid 584] <... exit_group resumed>) = ? [pid 582] <... exit_group resumed>) = ? [pid 297] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 588] +++ exited with 0 +++ [pid 297] lstat("./11/file1", [pid 586] +++ exited with 0 +++ [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 585] +++ exited with 0 +++ [pid 582] +++ exited with 0 +++ [pid 297] <... openat resumed>) = 4 [pid 297] fstat(4, [pid 587] +++ exited with 0 +++ [pid 584] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=582, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=584, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 297] getdents64(4, [pid 299] <... restart_syscall resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./11/file1") = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./11") = 0 [pid 297] mkdir("./12", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 608 [pid 300] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 608 attached [pid 608] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 608] chdir("./12") = 0 [pid 608] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 27.093858][ T600] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.093858][ T600] [ 27.099775][ T601] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 27.099775][ T601] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.099775][ T601] [ 27.139361][ T592] EXT4-fs (loop3): 1 orphan inode deleted [pid 608] setpgid(0, 0) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... openat resumed>) = 3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] fstat(3, [pid 299] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... openat resumed>) = 3 [pid 300] getdents64(3, [pid 299] fstat(3, [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] getdents64(3, [pid 300] <... umount2 resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = 0 [pid 300] lstat("./10/bus", [pid 299] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] unlink("./10/bus" [pid 299] lstat("./12/bus", [pid 300] <... unlink resumed>) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] unlink("./12/bus" [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... unlink resumed>) = 0 [pid 300] lstat("./10/binderfs", [pid 299] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] unlink("./10/binderfs" [pid 299] lstat("./12/binderfs", [pid 608] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 300] <... unlink resumed>) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] unlink("./12/binderfs" [pid 608] <... openat resumed>) = 3 [pid 299] <... unlink resumed>) = 0 [pid 299] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 608] write(3, "1000", 4 [pid 592] <... mount resumed>) = 0 [pid 592] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 592] chdir("./file1") = 0 [pid 592] ioctl(6, LOOP_CLR_FD) = 0 [pid 592] close(6) = 0 [pid 592] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 592] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 591] exit_group(0) = ? [pid 592] <... futex resumed>) = ? [pid 592] +++ exited with 0 +++ [pid 608] <... write resumed>) = 4 [pid 608] close(3) = 0 [pid 608] symlink("/dev/binderfs", "./binderfs") = 0 [pid 608] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 608] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 608] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 595] <... futex resumed>) = ? [pid 608] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 595] +++ exited with 0 +++ [pid 591] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=591, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 608] <... clone resumed>, parent_tid=[611], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 611 [pid 608] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... restart_syscall resumed>) = 0 [pid 298] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 608] <... futex resumed>) = 0 [pid 608] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 608] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 608] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 608] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[612], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 612 [pid 608] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 608] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 27.145019][ T592] EXT4-fs (loop3): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 27.173788][ T592] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/12/file1 supports timestamps until 2038 (0x7fffffff) [ 27.179153][ T601] EXT4-fs (loop1): 1 orphan inode deleted [ 27.194395][ T600] EXT4-fs (loop0): 1 orphan inode deleted [pid 298] fstat(3, ./strace-static-x86_64: Process 612 attached ./strace-static-x86_64: Process 611 attached {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 27.200293][ T600] EXT4-fs (loop0): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 27.203371][ T601] EXT4-fs (loop1): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 27.223325][ T600] ext4 filesystem being mounted at /root/syzkaller.d28Auw/11/file1 supports timestamps until 2038 (0x7fffffff) [pid 612] set_robust_list(0x7f35deafd9e0, 24 [pid 611] set_robust_list(0x7f35deb1e9e0, 24 [pid 608] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 600] <... mount resumed>) = 0 [pid 300] <... umount2 resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 298] getdents64(3, [pid 612] <... set_robust_list resumed>) = 0 [pid 611] <... set_robust_list resumed>) = 0 [pid 608] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 612] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 611] memfd_create("syzkaller", 0 [pid 608] <... futex resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 612] <... open resumed>) = 3 [pid 611] <... memfd_create resumed>) = 4 [pid 608] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] lstat("./10/file1", [pid 299] lstat("./12/file1", [pid 612] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 608] <... mmap resumed>) = 0x7f35deabc000 [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 612] <... futex resumed>) = 0 [pid 611] <... mmap resumed>) = 0x7f35d66bc000 [pid 608] mprotect(0x7f35deabd000, 131072, PROT_READ|PROT_WRITE [pid 300] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 612] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 611] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 608] <... mprotect resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 608] clone(child_stack=0x7f35deadc3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 300] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] <... openat resumed>) = 4 [pid 299] <... openat resumed>) = 4 [pid 608] <... clone resumed>, parent_tid=[613], tls=0x7f35deadc700, child_tidptr=0x7f35deadc9d0) = 613 [pid 300] fstat(4, [pid 299] fstat(4, [pid 608] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 608] <... futex resumed>) = 0 [pid 300] getdents64(4, [pid 299] getdents64(4, [pid 608] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] getdents64(4, [pid 299] getdents64(4, [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] close(4 [pid 299] close(4 [pid 300] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 300] rmdir("./10/file1" [pid 299] rmdir("./12/file1" [pid 300] <... rmdir resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 300] getdents64(3, [pid 299] getdents64(3, [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] close(3 [pid 299] close(3 [pid 611] <... write resumed>) = 262144 [pid 300] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 ./strace-static-x86_64: Process 613 attached [pid 611] munmap(0x7f35d66bc000, 262144 [pid 300] rmdir("./10" [pid 299] rmdir("./12" [pid 298] <... umount2 resumed>) = 0 [pid 601] <... mount resumed>) = 0 [pid 600] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 298] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 601] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 299] <... rmdir resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... rmdir resumed>) = 0 [pid 299] mkdir("./13", 0777 [pid 298] lstat("./12/bus", [pid 611] <... munmap resumed>) = 0 [pid 300] mkdir("./11", 0777 [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 601] <... openat resumed>) = 4 [pid 299] <... mkdir resumed>) = 0 [pid 298] unlink("./12/bus" [pid 300] <... mkdir resumed>) = 0 [pid 611] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 298] <... unlink resumed>) = 0 [pid 613] set_robust_list(0x7f35deadc9e0, 24 [pid 611] <... openat resumed>) = 5 [pid 601] chdir("./file1" [pid 600] <... openat resumed>) = 4 [pid 300] <... openat resumed>) = 3 [pid 299] <... openat resumed>) = 3 [pid 298] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 611] ioctl(5, LOOP_SET_FD, 4 [pid 601] <... chdir resumed>) = 0 [pid 600] chdir("./file1" [pid 300] ioctl(3, LOOP_CLR_FD [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 613] <... set_robust_list resumed>) = 0 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 613] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 613] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 613] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 601] ioctl(6, LOOP_CLR_FD) = 0 [pid 601] close(6) = 0 [pid 601] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 601] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 600] <... chdir resumed>) = 0 [pid 600] ioctl(6, LOOP_CLR_FD) = 0 [pid 600] close(6) = 0 [pid 600] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 600] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 614 [pid 298] lstat("./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] unlink("./12/binderfs") = 0 [pid 608] <... futex resumed>) = 0 [pid 300] close(3 [pid 298] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 611] <... ioctl resumed>) = 0 [pid 611] close(4) = 0 [pid 611] mkdir("./file1", 0777 [pid 593] exit_group(0 [pid 594] exit_group(0 [pid 603] <... futex resumed>) = ? [pid 593] <... exit_group resumed>) = ? [pid 603] +++ exited with 0 +++ [pid 602] <... futex resumed>) = ? [pid 594] <... exit_group resumed>) = ? [pid 602] +++ exited with 0 +++ [pid 608] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 614 attached ) = 1 [pid 612] <... futex resumed>) = 0 [pid 600] <... futex resumed>) = ? [pid 612] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 608] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 614] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 600] +++ exited with 0 +++ [pid 594] +++ exited with 0 +++ [pid 612] <... open resumed>) = 4 [pid 612] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] <... futex resumed>) = ? [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=594, si_uid=0, si_status=0, si_utime=0, si_stime=9} --- [pid 612] <... futex resumed>) = 1 [pid 608] <... futex resumed>) = 0 [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 614] chdir("./13" [pid 601] +++ exited with 0 +++ [pid 593] +++ exited with 0 +++ [pid 295] <... restart_syscall resumed>) = 0 [pid 612] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 608] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=593, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 614] <... chdir resumed>) = 0 [pid 614] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 614] setpgid(0, 0) = 0 [pid 614] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 608] <... futex resumed>) = 0 [pid 296] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 614] <... openat resumed>) = 3 [pid 614] write(3, "1000", 4) = 4 [pid 614] close(3 [pid 608] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... openat resumed>) = 3 [pid 295] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] <... close resumed>) = 0 [pid 296] fstat(3, [pid 295] <... openat resumed>) = 3 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] fstat(3, [pid 296] getdents64(3, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 615 [pid 612] <... write resumed>) = 262144 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] getdents64(3, [pid 296] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 612] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 612] <... futex resumed>) = 1 [pid 608] <... futex resumed>) = 0 [pid 296] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 612] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = 0 [pid 296] lstat("./10/bus", [pid 295] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] unlink("./10/bus" [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... unlink resumed>) = 0 [pid 295] lstat("./11/bus", [pid 296] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] unlink("./11/bus" [pid 296] lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] <... unlink resumed>) = 0 [pid 296] unlink("./10/binderfs" [pid 295] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... unlink resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 614] <... close resumed>) = 0 [pid 295] unlink("./11/binderfs" [pid 614] symlink("/dev/binderfs", "./binderfs" [pid 295] <... unlink resumed>) = 0 [pid 295] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 614] <... symlink resumed>) = 0 [pid 614] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 614] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 614] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 614] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[616], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 616 [pid 614] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 614] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 614] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 614] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 611] <... mkdir resumed>) = 0 [pid 611] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 614] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[617], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 617 [pid 614] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 614] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 617 attached [pid 617] set_robust_list(0x7f35deafd9e0, 24) = 0 [ 27.247680][ T601] ext4 filesystem being mounted at /root/syzkaller.5s3MMz/10/file1 supports timestamps until 2038 (0x7fffffff) [ 27.277429][ T611] loop2: detected capacity change from 0 to 512 [pid 617] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 617] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 614] <... futex resumed>) = 0 [pid 614] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 614] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 617] <... futex resumed>) = 1 [pid 617] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 617] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 614] <... futex resumed>) = 0 [pid 614] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 614] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 617] <... futex resumed>) = 1 [pid 617] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 617] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 614] <... futex resumed>) = 0 [pid 614] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 614] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 617] <... futex resumed>) = 1 [pid 617] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 617] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 614] <... futex resumed>) = 0 ./strace-static-x86_64: Process 615 attached [pid 615] set_robust_list(0x555556c9c5e0, 24 [pid 617] <... futex resumed>) = 1 [pid 617] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 615] <... set_robust_list resumed>) = 0 [pid 615] chdir("./11") = 0 [pid 615] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 611] <... mount resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 616 attached [pid 615] <... prctl resumed>) = 0 [pid 611] ioctl(5, LOOP_CLR_FD [pid 616] set_robust_list(0x7f35deb1e9e0, 24 [pid 615] setpgid(0, 0 [pid 611] <... ioctl resumed>) = 0 [pid 615] <... setpgid resumed>) = 0 [pid 615] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 616] <... set_robust_list resumed>) = 0 [pid 615] <... openat resumed>) = 3 [pid 611] close(5 [pid 615] write(3, "1000", 4) = 4 [pid 615] close(3) = 0 [pid 615] symlink("/dev/binderfs", "./binderfs") = 0 [pid 611] <... close resumed>) = 0 [pid 615] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 615] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 615] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 615] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[618], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 618 [pid 615] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 615] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 615] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 615] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 615] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 611] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 615] <... clone resumed>, parent_tid=[619], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 619 [pid 615] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] <... futex resumed>) = 0 [pid 615] <... futex resumed>) = 0 [pid 615] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 611] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 608] exit_group(0 [pid 613] <... futex resumed>) = ? [pid 612] <... futex resumed>) = ? [pid 611] <... futex resumed>) = ? [pid 608] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 619 attached ./strace-static-x86_64: Process 618 attached [pid 616] memfd_create("syzkaller", 0 [pid 613] +++ exited with 0 +++ [pid 612] +++ exited with 0 +++ [pid 611] +++ exited with 0 +++ [pid 619] set_robust_list(0x7f35deafd9e0, 24 [pid 618] set_robust_list(0x7f35deb1e9e0, 24 [pid 616] <... memfd_create resumed>) = 5 [pid 298] <... umount2 resumed>) = 0 [pid 619] <... set_robust_list resumed>) = 0 [pid 618] <... set_robust_list resumed>) = 0 [pid 616] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 619] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 618] memfd_create("syzkaller", 0 [pid 616] <... mmap resumed>) = 0x7f35d66dd000 [pid 298] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 619] <... open resumed>) = 3 [pid 618] <... memfd_create resumed>) = 4 [pid 616] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 619] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 618] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 616] <... write resumed>) = 262144 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 618] <... mmap resumed>) = 0x7f35d66dd000 [pid 616] munmap(0x7f35d66dd000, 262144 [pid 619] <... futex resumed>) = 1 [pid 618] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 616] <... munmap resumed>) = 0 [pid 615] <... futex resumed>) = 0 [pid 298] lstat("./12/file1", [pid 619] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 618] <... write resumed>) = 262144 [pid 616] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 615] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 618] munmap(0x7f35d66dd000, 262144 [pid 616] <... openat resumed>) = 6 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 615] <... futex resumed>) = 0 [pid 619] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 618] <... munmap resumed>) = 0 [pid 616] ioctl(6, LOOP_SET_FD, 5 [pid 298] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 615] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 619] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 619] <... mount resumed>) = 0 [pid 298] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 619] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... openat resumed>) = 4 [pid 619] <... futex resumed>) = 1 [pid 615] <... futex resumed>) = 0 [pid 298] fstat(4, [pid 619] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 615] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 619] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 615] <... futex resumed>) = 0 [pid 298] getdents64(4, [pid 619] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 615] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 619] <... open resumed>) = 5 [pid 298] getdents64(4, [pid 619] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 619] <... futex resumed>) = 1 [pid 615] <... futex resumed>) = 0 [pid 298] close(4 [pid 619] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 615] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 619] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 615] <... futex resumed>) = 0 [pid 298] rmdir("./12/file1" [pid 619] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 615] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... rmdir resumed>) = 0 [pid 619] <... futex resumed>) = 0 [pid 615] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] getdents64(3, [pid 619] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./12") = 0 [pid 298] mkdir("./13", 0777 [pid 618] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 616] <... ioctl resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 618] <... openat resumed>) = 6 [pid 616] close(5 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 618] ioctl(6, LOOP_SET_FD, 4 [pid 616] <... close resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD [pid 618] <... ioctl resumed>) = 0 [pid 616] mkdir("./file1", 0777 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 618] close(4 [pid 298] close(3 [pid 296] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 618] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 618] mkdir("./file1", 0777 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] lstat("./10/file1", [pid 295] lstat("./11/file1", ./strace-static-x86_64: Process 620 attached [pid 618] <... mkdir resumed>) = 0 [pid 616] <... mkdir resumed>) = 0 [pid 618] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 620 [pid 608] +++ exited with 0 +++ [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=608, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 297] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [ 27.304721][ T611] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [ 27.325770][ T616] loop4: detected capacity change from 0 to 512 [ 27.333388][ T618] loop5: detected capacity change from 0 to 512 [pid 620] set_robust_list(0x555556c9c5e0, 24 [pid 616] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 297] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 620] <... set_robust_list resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./12/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] unlink("./12/bus") = 0 [pid 297] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./12/binderfs") = 0 [pid 297] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./12/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./12/file1") = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./12") = 0 [pid 297] mkdir("./13", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 622 ./strace-static-x86_64: Process 622 attached [pid 622] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 622] chdir("./13") = 0 [pid 622] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 622] setpgid(0, 0) = 0 [pid 622] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 622] write(3, "1000", 4) = 4 [pid 622] close(3) = 0 [pid 622] symlink("/dev/binderfs", "./binderfs") = 0 [pid 622] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 622] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 622] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 620] chdir("./13" [pid 296] <... openat resumed>) = 4 [pid 620] <... chdir resumed>) = 0 [pid 296] fstat(4, [pid 295] <... openat resumed>) = 4 [pid 620] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] fstat(4, [pid 620] <... prctl resumed>) = 0 [pid 296] getdents64(4, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 620] setpgid(0, 0) = 0 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, [pid 296] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 620] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] close(4 [pid 295] getdents64(4, [pid 620] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 620] write(3, "1000", 4 [pid 296] rmdir("./10/file1" [pid 295] close(4 [pid 620] <... write resumed>) = 4 [pid 622] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 620] close(3 [pid 296] <... rmdir resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 620] <... close resumed>) = 0 [pid 296] getdents64(3, [pid 295] rmdir("./11/file1" [pid 620] symlink("/dev/binderfs", "./binderfs" [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 622] <... clone resumed>, parent_tid=[623], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 623 [pid 295] <... rmdir resumed>) = 0 [pid 622] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] <... symlink resumed>) = 0 [pid 296] close(3 [pid 295] getdents64(3, [pid 622] <... futex resumed>) = 0 [pid 620] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 622] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] <... futex resumed>) = 0 [pid 296] rmdir("./10" [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 622] <... futex resumed>) = 0 [pid 620] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 622] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 620] <... mmap resumed>) = 0x7f35deafe000 [pid 296] <... rmdir resumed>) = 0 [pid 295] close(3 [pid 622] <... mmap resumed>) = 0x7f35deadd000 [pid 620] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 296] mkdir("./11", 0777 [pid 620] <... mprotect resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 622] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 620] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] <... mkdir resumed>) = 0 [pid 295] rmdir("./11" [pid 622] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 620] <... clone resumed>, parent_tid=[624], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 624 [pid 295] <... rmdir resumed>) = 0 [pid 622] <... clone resumed>, parent_tid=[625], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 625 [pid 620] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 3 [pid 295] mkdir("./12", 0777./strace-static-x86_64: Process 624 attached [pid 622] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] <... futex resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 622] <... futex resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 624] set_robust_list(0x7f35deb1e9e0, 24 [pid 622] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 620] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 624] <... set_robust_list resumed>) = 0 [pid 620] <... futex resumed>) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 624] memfd_create("syzkaller", 0 [pid 620] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] close(3 [pid 624] <... memfd_create resumed>) = 3 [pid 620] <... mmap resumed>) = 0x7f35deadd000 [pid 296] <... close resumed>) = 0 [pid 295] <... openat resumed>) = 3 ./strace-static-x86_64: Process 623 attached [pid 623] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 623] memfd_create("syzkaller", 0) = 3 [pid 620] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 624] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] ioctl(3, LOOP_CLR_FD [pid 623] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 ./strace-static-x86_64: Process 625 attached [pid 625] set_robust_list(0x7f35deafd9e0, 24 [pid 620] <... mprotect resumed>) = 0 [pid 625] <... set_robust_list resumed>) = 0 [pid 624] <... mmap resumed>) = 0x7f35d66dd000 [pid 620] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 625] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 625] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 625] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 624] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 626 [pid 295] close(3 [pid 624] <... write resumed>) = 262144 [pid 623] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 620] <... clone resumed>, parent_tid=[627], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 627 [pid 295] <... close resumed>) = 0 [pid 624] munmap(0x7f35d66dd000, 262144 [pid 620] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 620] <... futex resumed>) = 0 [pid 624] <... munmap resumed>) = 0 [pid 620] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 624] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 628 [pid 624] <... openat resumed>) = 4 [pid 624] ioctl(4, LOOP_SET_FD, 3 [pid 623] <... write resumed>) = 262144 [pid 622] <... futex resumed>) = 0 ./strace-static-x86_64: Process 626 attached [pid 626] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 623] munmap(0x7f35d66dd000, 262144 [pid 626] chdir("./11" [pid 623] <... munmap resumed>) = 0 [pid 626] <... chdir resumed>) = 0 [pid 623] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 626] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 623] <... openat resumed>) = 5 [pid 626] <... prctl resumed>) = 0 [ 27.352952][ T618] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 27.352952][ T618] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.352952][ T618] [ 27.375810][ T616] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 27.375810][ T616] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.375810][ T616] [pid 623] ioctl(5, LOOP_SET_FD, 3./strace-static-x86_64: Process 627 attached [pid 626] setpgid(0, 0 [pid 624] <... ioctl resumed>) = 0 [pid 622] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] set_robust_list(0x7f35deafd9e0, 24 [pid 626] <... setpgid resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 624] close(3 [pid 622] <... futex resumed>) = 1 ./strace-static-x86_64: Process 628 attached [pid 627] <... set_robust_list resumed>) = 0 [pid 625] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 624] <... close resumed>) = 0 [pid 623] <... ioctl resumed>) = 0 [pid 622] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 626] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 628] set_robust_list(0x555556c9c5e0, 24 [pid 627] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 625] <... mount resumed>) = 0 [pid 624] mkdir("./file1", 0777 [pid 623] close(3 [pid 628] <... set_robust_list resumed>) = 0 [pid 627] <... open resumed>) = 3 [pid 626] <... openat resumed>) = 3 [pid 625] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 624] <... mkdir resumed>) = 0 [pid 628] chdir("./12" [pid 627] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 626] write(3, "1000", 4 [pid 625] <... futex resumed>) = 1 [pid 622] <... futex resumed>) = 0 [pid 626] <... write resumed>) = 4 [pid 625] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 626] close(3) = 0 [pid 626] symlink("/dev/binderfs", "./binderfs") = 0 [pid 626] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 626] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 626] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 626] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[631], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 631 [pid 626] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 626] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 628] <... chdir resumed>) = 0 [pid 627] <... futex resumed>) = 1 [ 27.417471][ T624] loop3: detected capacity change from 0 to 512 [ 27.418222][ T623] loop2: detected capacity change from 0 to 512 [ 27.433435][ T616] EXT4-fs (loop4): 1 orphan inode deleted [ 27.439130][ T616] EXT4-fs (loop4): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [pid 624] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 623] <... close resumed>) = 0 [pid 622] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] <... futex resumed>) = 0 [pid 628] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 627] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 626] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 622] <... futex resumed>) = 1 [pid 620] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] <... mount resumed>) = 0 [pid 628] <... prctl resumed>) = 0 [pid 627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 622] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 620] <... futex resumed>) = 0 [pid 628] setpgid(0, 0 [pid 627] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 620] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 623] mkdir("./file1", 0777 [pid 625] <... futex resumed>) = 0 [pid 628] <... setpgid resumed>) = 0 [pid 627] <... mount resumed>) = 0 [pid 626] <... mmap resumed>) = 0x7f35deadd000 [pid 628] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 627] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 628] <... openat resumed>) = 3 [pid 627] <... futex resumed>) = 1 [pid 620] <... futex resumed>) = 0 [pid 628] write(3, "1000", 4 [pid 627] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 620] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] <... write resumed>) = 4 [pid 627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 626] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 623] <... mkdir resumed>) = 0 [pid 620] <... futex resumed>) = 0 [pid 628] close(3 [pid 627] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 625] <... open resumed>) = 3 [pid 620] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 628] <... close resumed>) = 0 [pid 627] <... open resumed>) = 5 [pid 626] <... mprotect resumed>) = 0 [pid 625] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] symlink("/dev/binderfs", "./binderfs" [pid 627] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 623] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 628] <... symlink resumed>) = 0 [pid 627] <... futex resumed>) = 1 [pid 626] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 625] <... futex resumed>) = 1 [pid 622] <... futex resumed>) = 0 [pid 620] <... futex resumed>) = 0 [ 27.440102][ T624] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 27.440102][ T624] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.440102][ T624] [ 27.462300][ T616] ext4 filesystem being mounted at /root/syzkaller.RJEgPO/13/file1 supports timestamps until 2038 (0x7fffffff) [ 27.495351][ T623] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 27.495351][ T623] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.495351][ T623] [pid 616] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY./strace-static-x86_64: Process 634 attached ./strace-static-x86_64: Process 631 attached [pid 628] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 625] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 622] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] <... futex resumed>) = 0 [pid 627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 622] <... futex resumed>) = 0 [pid 620] <... futex resumed>) = 0 [pid 628] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 627] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 622] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 620] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 628] <... mmap resumed>) = 0x7f35deafe000 [pid 627] <... write resumed>) = 262144 [pid 628] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 627] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] <... mprotect resumed>) = 0 [pid 627] <... futex resumed>) = 1 [pid 620] <... futex resumed>) = 0 [pid 628] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 627] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] <... clone resumed>, parent_tid=[635], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 635 [pid 628] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 628] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 628] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 628] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 628] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[636], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 636 [pid 628] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 628] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 631] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 631] memfd_create("syzkaller", 0) = 3 [pid 631] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 631] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 631] munmap(0x7f35d66dd000, 262144) = 0 [pid 631] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [ 27.496384][ T618] EXT4-fs (loop5): 1 orphan inode deleted [ 27.519286][ T618] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 27.530453][ T631] loop1: detected capacity change from 0 to 512 [ 27.542055][ T618] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/11/file1 supports timestamps until 2038 (0x7fffffff) [ 27.550525][ T624] EXT4-fs (loop3): Magic mismatch, very weird! [pid 631] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 636 attached ./strace-static-x86_64: Process 635 attached [pid 634] set_robust_list(0x7f35deafd9e0, 24 [pid 631] <... ioctl resumed>) = 0 [pid 626] <... clone resumed>, parent_tid=[634], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 634 [pid 618] <... mount resumed>) = 0 [pid 616] <... openat resumed>) = 5 [pid 636] set_robust_list(0x7f35deafd9e0, 24 [pid 635] set_robust_list(0x7f35deb1e9e0, 24 [pid 618] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 636] <... set_robust_list resumed>) = 0 [pid 635] <... set_robust_list resumed>) = 0 [pid 618] <... openat resumed>) = 4 [pid 636] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 635] memfd_create("syzkaller", 0 [pid 618] chdir("./file1" [pid 636] <... open resumed>) = 3 [pid 635] <... memfd_create resumed>) = 4 [pid 618] <... chdir resumed>) = 0 [pid 636] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 635] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 618] ioctl(6, LOOP_CLR_FD [pid 636] <... futex resumed>) = 1 [pid 635] <... mmap resumed>) = 0x7f35d66dd000 [pid 618] <... ioctl resumed>) = 0 [pid 636] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 635] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 618] close(6 [pid 635] <... write resumed>) = 262144 [pid 618] <... close resumed>) = 0 [pid 635] munmap(0x7f35d66dd000, 262144 [pid 618] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 635] <... munmap resumed>) = 0 [pid 618] <... futex resumed>) = 0 [pid 635] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 618] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 635] <... openat resumed>) = 5 [pid 635] ioctl(5, LOOP_SET_FD, 4) = 0 [pid 634] <... set_robust_list resumed>) = 0 [pid 628] <... futex resumed>) = 0 [pid 626] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] <... write resumed>) = 262144 [pid 624] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 616] chdir("./file1" [pid 615] exit_group(0 [pid 635] close(4 [pid 634] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 626] <... futex resumed>) = 0 [pid 625] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 624] ioctl(4, LOOP_CLR_FD [pid 618] <... futex resumed>) = ? [pid 616] <... chdir resumed>) = 0 [pid 615] <... exit_group resumed>) = ? [pid 635] <... close resumed>) = 0 [pid 634] <... open resumed>) = 5 [pid 626] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 625] <... futex resumed>) = 1 [pid 624] <... ioctl resumed>) = 0 [pid 618] +++ exited with 0 +++ [pid 616] ioctl(6, LOOP_CLR_FD [pid 635] mkdir("./file1", 0777 [pid 634] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 626] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 625] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 624] close(4 [pid 622] <... futex resumed>) = 0 [pid 619] <... futex resumed>) = ? [pid 616] <... ioctl resumed>) = 0 [pid 636] <... futex resumed>) = 0 [pid 635] <... mkdir resumed>) = 0 [pid 634] <... futex resumed>) = 0 [pid 631] close(3 [pid 628] <... futex resumed>) = 1 [pid 626] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 624] <... close resumed>) = 0 [pid 623] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 619] +++ exited with 0 +++ [pid 616] close(6 [pid 615] +++ exited with 0 +++ [pid 636] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 635] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 634] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 628] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 626] <... futex resumed>) = 0 [pid 624] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] exit_group(0 [pid 616] <... close resumed>) = 0 [pid 636] <... mount resumed>) = 0 [pid 634] <... mount resumed>) = 0 [pid 631] <... close resumed>) = 0 [pid 627] <... futex resumed>) = ? [pid 623] ioctl(5, LOOP_CLR_FD [pid 620] <... exit_group resumed>) = ? [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=615, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 636] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 634] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] mkdir("./file1", 0777 [pid 627] +++ exited with 0 +++ [pid 623] <... ioctl resumed>) = 0 [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 636] <... futex resumed>) = 1 [pid 634] <... futex resumed>) = 0 [pid 631] <... mkdir resumed>) = 0 [pid 628] <... futex resumed>) = 0 [pid 623] close(5 [pid 300] <... restart_syscall resumed>) = 0 [ 27.564090][ T635] loop0: detected capacity change from 0 to 512 [ 27.570204][ T623] EXT4-fs (loop2): Magic mismatch, very weird! [ 27.584486][ T635] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 27.584486][ T635] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.584486][ T635] [ 27.604307][ T631] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [pid 636] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 634] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 631] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 628] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 626] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 624] <... futex resumed>) = ? [pid 623] <... close resumed>) = 0 [pid 616] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 636] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 628] <... futex resumed>) = 0 [pid 626] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 616] <... futex resumed>) = 0 [pid 626] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 614] exit_group(0 [pid 626] <... futex resumed>) = 1 [pid 617] <... futex resumed>) = ? [pid 616] <... futex resumed>) = ? [pid 614] <... exit_group resumed>) = ? [pid 636] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 634] <... futex resumed>) = 0 [pid 628] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 626] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 623] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 617] +++ exited with 0 +++ [pid 616] +++ exited with 0 +++ [pid 614] +++ exited with 0 +++ [pid 636] <... open resumed>) = 4 [pid 634] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 623] <... futex resumed>) = 0 [pid 300] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 636] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=614, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 636] <... futex resumed>) = 1 [pid 634] <... open resumed>) = 3 [pid 628] <... futex resumed>) = 0 [pid 623] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 636] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 634] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 636] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 634] <... futex resumed>) = 1 [pid 628] <... futex resumed>) = 0 [pid 626] <... futex resumed>) = 0 [pid 299] <... restart_syscall resumed>) = 0 [pid 628] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 626] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... openat resumed>) = 3 [pid 636] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 634] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 626] <... futex resumed>) = 0 [pid 300] fstat(3, [pid 636] <... write resumed>) = 262144 [pid 626] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 636] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 622] exit_group(0 [pid 300] getdents64(3, [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 636] <... futex resumed>) = 1 [pid 628] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = ? [pid 623] <... futex resumed>) = ? [pid 622] <... exit_group resumed>) = ? [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 636] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 625] +++ exited with 0 +++ [pid 623] +++ exited with 0 +++ [pid 300] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... openat resumed>) = 3 [pid 299] fstat(3, [pid 300] <... umount2 resumed>) = 0 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] getdents64(3, [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] lstat("./11/bus", [pid 299] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] unlink("./11/bus") = 0 [pid 300] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] unlink("./11/binderfs") = 0 [pid 300] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 634] <... write resumed>) = 262144 [pid 634] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 626] <... futex resumed>) = 0 [pid 634] <... futex resumed>) = 1 [pid 634] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 631] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] <... umount2 resumed>) = 0 [pid 299] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./13/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] unlink("./13/bus") = 0 [pid 299] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./13/binderfs", [pid 624] +++ exited with 0 +++ [pid 620] +++ exited with 0 +++ [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./13/binderfs" [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=620, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [ 27.604307][ T631] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.604307][ T631] [ 27.628865][ T635] EXT4-fs error (device loop0): __ext4_get_inode_loc:4350: comm syz-executor252: Invalid inode table block 0 in block_group 0 [ 27.642803][ T631] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 27.645586][ T635] EXT4-fs (loop0): get root inode failed [ 27.652669][ T631] EXT4-fs (loop1): group descriptors corrupted! [ 27.659256][ T635] EXT4-fs (loop0): mount failed [pid 299] <... unlink resumed>) = 0 [pid 299] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 631] ioctl(4, LOOP_CLR_FD) = 0 [pid 298] getdents64(3, [pid 635] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 631] close(4 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 631] <... close resumed>) = 0 [pid 631] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 631] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 635] ioctl(5, LOOP_CLR_FD [pid 626] exit_group(0) = ? [pid 634] <... futex resumed>) = ? [pid 631] <... futex resumed>) = ? [pid 635] <... ioctl resumed>) = 0 [pid 634] +++ exited with 0 +++ [pid 298] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 635] close(5) = 0 [pid 635] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 635] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... umount2 resumed>) = 0 [pid 298] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./13/bus", [pid 628] exit_group(0 [pid 636] <... futex resumed>) = ? [pid 628] <... exit_group resumed>) = ? [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 636] +++ exited with 0 +++ [pid 298] unlink("./13/bus" [pid 635] <... futex resumed>) = ? [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] unlink("./13/binderfs") = 0 [pid 298] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./13/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./13/file1") = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./13" [pid 622] +++ exited with 0 +++ [pid 298] <... rmdir resumed>) = 0 [pid 298] mkdir("./14", 0777 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=622, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 297] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, [pid 298] <... mkdir resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 297] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... openat resumed>) = 3 [pid 297] <... umount2 resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] lstat("./13/bus", [pid 298] close(3 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] unlink("./13/bus" [pid 298] <... close resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./13/binderfs") = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 638 [pid 297] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./13/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./13/file1") = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./13"./strace-static-x86_64: Process 638 attached ) = 0 [pid 297] mkdir("./14", 0777 [pid 638] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 638] chdir("./14" [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 638] <... chdir resumed>) = 0 [pid 638] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 638] setpgid(0, 0) = 0 [pid 297] <... openat resumed>) = 3 [pid 638] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 638] <... openat resumed>) = 3 [pid 297] <... close resumed>) = 0 [pid 638] write(3, "1000", 4 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 638] <... write resumed>) = 4 [pid 638] close(3) = 0 [pid 638] symlink("/dev/binderfs", "./binderfs") = 0 [pid 638] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 639 [pid 638] <... futex resumed>) = 0 [pid 638] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 638] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 638] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 640 attached , parent_tid=[640], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 640 [pid 638] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 638] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 638] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 640] set_robust_list(0x7f35deb1e9e0, 24 [pid 638] <... mmap resumed>) = 0x7f35deadd000 [pid 638] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 638] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 641 attached [pid 640] <... set_robust_list resumed>) = 0 [pid 638] <... clone resumed>, parent_tid=[641], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 641 [pid 638] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 638] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 639 attached [pid 641] set_robust_list(0x7f35deafd9e0, 24 [pid 640] memfd_create("syzkaller", 0 [pid 639] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 641] <... set_robust_list resumed>) = 0 [pid 640] <... memfd_create resumed>) = 3 [pid 639] chdir("./14") = 0 [pid 639] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 639] setpgid(0, 0) = 0 [pid 641] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 640] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 639] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 640] <... mmap resumed>) = 0x7f35d66dd000 [pid 639] write(3, "1000", 4) = 4 [pid 639] close(3) = 0 [pid 639] symlink("/dev/binderfs", "./binderfs") = 0 [pid 639] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 639] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 639] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[642], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 642 [pid 639] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 639] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 639] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[643], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 643 [pid 639] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 639] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 642 attached [pid 642] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 642] memfd_create("syzkaller", 0) = 3 [pid 642] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 640] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 641] <... open resumed>) = 4 [pid 640] <... write resumed>) = 262144 [pid 641] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 643 attached [pid 642] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 300] <... umount2 resumed>) = 0 [pid 643] set_robust_list(0x7f35deafd9e0, 24 [pid 641] <... futex resumed>) = 1 [pid 640] munmap(0x7f35d66dd000, 262144 [pid 300] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = 0 [pid 638] <... futex resumed>) = 0 [pid 638] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 638] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 640] <... munmap resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 643] <... set_robust_list resumed>) = 0 [pid 641] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 640] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 300] lstat("./11/file1", [pid 299] lstat("./13/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 640] <... openat resumed>) = 5 [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 641] <... mount resumed>) = 0 [pid 299] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 640] ioctl(5, LOOP_SET_FD, 3 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 642] <... write resumed>) = 262144 [pid 642] munmap(0x7f35d66dd000, 262144) = 0 [pid 642] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 642] ioctl(4, LOOP_SET_FD, 3 [pid 643] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 641] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 640] <... ioctl resumed>) = 0 [pid 300] <... openat resumed>) = 4 [pid 299] <... openat resumed>) = 4 [pid 643] <... open resumed>) = 5 [pid 642] <... ioctl resumed>) = 0 [pid 641] <... futex resumed>) = 1 [pid 640] close(3 [pid 638] <... futex resumed>) = 0 [pid 635] +++ exited with 0 +++ [pid 631] +++ exited with 0 +++ [pid 628] +++ exited with 0 +++ [pid 626] +++ exited with 0 +++ [pid 300] fstat(4, [pid 299] fstat(4, [pid 641] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(4, [pid 299] getdents64(4, [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=626, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=628, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] getdents64(4, [pid 299] getdents64(4, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] close(4 [pid 299] close(4 [pid 296] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 300] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 296] fstat(3, [pid 295] fstat(3, [pid 300] rmdir("./11/file1" [pid 299] rmdir("./13/file1" [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 296] getdents64(3, [pid 295] getdents64(3, [pid 300] getdents64(3, [pid 299] getdents64(3, [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 638] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] close(3 [pid 299] close(3 [pid 296] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 641] <... futex resumed>) = 0 [pid 638] <... futex resumed>) = 1 [pid 296] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 641] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 638] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 641] <... open resumed>) = 6 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 641] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] lstat("./11/bus", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 641] <... futex resumed>) = 1 [pid 638] <... futex resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] lstat("./12/bus", [pid 641] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 638] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] unlink("./11/bus" [pid 641] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 638] <... futex resumed>) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 641] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 638] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] unlink("./12/bus" [pid 300] rmdir("./11" [pid 299] rmdir("./13" [pid 300] <... rmdir resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 300] mkdir("./12", 0777 [pid 299] mkdir("./14", 0777 [pid 300] <... mkdir resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 296] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... unlink resumed>) = 0 [pid 300] <... openat resumed>) = 3 [pid 299] <... openat resumed>) = 3 [pid 300] ioctl(3, LOOP_CLR_FD [pid 299] ioctl(3, LOOP_CLR_FD [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] close(3 [pid 299] close(3 [pid 300] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 641] <... write resumed>) = 262144 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 641] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 644 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 645 [pid 296] lstat("./11/binderfs", [pid 641] <... futex resumed>) = 1 [pid 638] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 641] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] lstat("./12/binderfs", [pid 643] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] unlink("./11/binderfs" [pid 643] <... futex resumed>) = 1 [pid 639] <... futex resumed>) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 643] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 639] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... unlink resumed>) = 0 [pid 295] unlink("./12/binderfs" [pid 643] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 639] <... futex resumed>) = 0 [pid 296] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 643] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 639] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... unlink resumed>) = 0 [pid 643] <... mount resumed>) = 0 [pid 296] lstat("./11/file1", [pid 295] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 643] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 643] <... futex resumed>) = 1 [pid 639] <... futex resumed>) = 0 [pid 643] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 639] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] lstat("./12/file1", [pid 643] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 639] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 643] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 639] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 ./strace-static-x86_64: Process 644 attached [pid 643] <... open resumed>) = 6 [pid 296] <... openat resumed>) = 4 [pid 295] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 644] set_robust_list(0x555556c9c5e0, 24 [pid 643] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 640] <... close resumed>) = 0 [pid 296] fstat(4, [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 644] <... set_robust_list resumed>) = 0 [pid 643] <... futex resumed>) = 1 [pid 642] close(3 [pid 640] mkdir("./file1", 0777 [pid 639] <... futex resumed>) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 644] chdir("./12" [pid 643] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 642] <... close resumed>) = 0 [pid 640] <... mkdir resumed>) = 0 [pid 639] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] getdents64(4, [pid 295] <... openat resumed>) = 4 [pid 642] mkdir("./file1", 0777 [pid 640] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 644] <... chdir resumed>) = 0 [pid 642] <... mkdir resumed>) = 0 [pid 639] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] fstat(4, [pid 642] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 643] <... write resumed>) = 262144 [pid 639] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(4, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 644] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 643] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 639] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] getdents64(4, [pid 644] <... prctl resumed>) = 0 [pid 643] <... futex resumed>) = 0 [pid 643] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 645 attached [pid 296] close(4 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [ 27.703154][ T640] loop3: detected capacity change from 0 to 512 [ 27.703828][ T642] loop2: detected capacity change from 0 to 512 [ 27.740501][ T640] EXT4-fs (loop3): VFS: Can't find ext4 filesystem [pid 644] setpgid(0, 0 [pid 645] set_robust_list(0x555556c9c5e0, 24 [pid 644] <... setpgid resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 295] getdents64(4, [pid 645] <... set_robust_list resumed>) = 0 [pid 644] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] rmdir("./11/file1" [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 645] chdir("./14" [pid 644] <... openat resumed>) = 3 [pid 645] <... chdir resumed>) = 0 [pid 644] write(3, "1000", 4 [pid 296] <... rmdir resumed>) = 0 [pid 295] close(4 [pid 645] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 644] <... write resumed>) = 4 [pid 645] <... prctl resumed>) = 0 [pid 644] close(3 [pid 296] getdents64(3, [pid 295] <... close resumed>) = 0 [pid 645] setpgid(0, 0 [pid 644] <... close resumed>) = 0 [pid 645] <... setpgid resumed>) = 0 [pid 644] symlink("/dev/binderfs", "./binderfs" [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] rmdir("./12/file1" [pid 645] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 644] <... symlink resumed>) = 0 [pid 645] <... openat resumed>) = 3 [pid 644] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] close(3 [pid 295] <... rmdir resumed>) = 0 [pid 645] write(3, "1000", 4 [pid 644] <... futex resumed>) = 0 [pid 645] <... write resumed>) = 4 [pid 644] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... close resumed>) = 0 [pid 295] getdents64(3, [pid 645] close(3 [pid 644] <... mmap resumed>) = 0x7f35deafe000 [pid 645] <... close resumed>) = 0 [pid 644] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 296] rmdir("./11" [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 645] symlink("/dev/binderfs", "./binderfs" [pid 644] <... mprotect resumed>) = 0 [pid 645] <... symlink resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] close(3 [pid 644] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 645] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] mkdir("./12", 0777 [pid 295] <... close resumed>) = 0 [pid 645] <... futex resumed>) = 0 [pid 644] <... clone resumed>, parent_tid=[646], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 646 [pid 645] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 645] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 644] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... mkdir resumed>) = 0 [pid 295] rmdir("./12" [pid 644] <... futex resumed>) = 0 [pid 645] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 295] <... rmdir resumed>) = 0 [pid 644] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 295] mkdir("./13", 0777 [pid 644] <... futex resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 644] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] <... mkdir resumed>) = 0 [pid 645] <... clone resumed>, parent_tid=[647], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 647 [pid 644] <... mmap resumed>) = 0x7f35deadd000 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 645] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 644] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 645] <... futex resumed>) = 0 [pid 296] close(3 [pid 644] <... mprotect resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 645] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 644] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] <... close resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 645] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 645] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 644] <... clone resumed>, parent_tid=[648], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 648 [pid 295] close(3 [pid 645] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 644] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... close resumed>) = 0 [pid 645] <... clone resumed>, parent_tid=[649], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 649 [pid 644] <... futex resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 650 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 645] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 644] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 645] <... futex resumed>) = 0 [pid 645] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 647 attached [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 651 [pid 647] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 647] memfd_create("syzkaller", 0) = 3 [pid 647] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 ./strace-static-x86_64: Process 650 attached ./strace-static-x86_64: Process 649 attached ./strace-static-x86_64: Process 648 attached [pid 649] set_robust_list(0x7f35deafd9e0, 24 [pid 642] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 640] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 649] <... set_robust_list resumed>) = 0 [pid 642] ioctl(4, LOOP_CLR_FD [pid 640] ioctl(5, LOOP_CLR_FD [pid 649] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 642] <... ioctl resumed>) = 0 [pid 640] <... ioctl resumed>) = 0 [pid 649] <... open resumed>) = 4 [pid 648] set_robust_list(0x7f35deafd9e0, 24 [pid 642] close(4 [pid 640] close(5./strace-static-x86_64: Process 651 attached [pid 650] set_robust_list(0x555556c9c5e0, 24 [pid 649] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 648] <... set_robust_list resumed>) = 0 [pid 642] <... close resumed>) = 0 [pid 640] <... close resumed>) = 0 [pid 650] <... set_robust_list resumed>) = 0 [pid 648] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 651] set_robust_list(0x555556c9c5e0, 24 [pid 650] chdir("./12" [pid 649] <... futex resumed>) = 1 [pid 648] <... open resumed>) = 3 [pid 647] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 645] <... futex resumed>) = 0 [pid 642] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 640] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 646 attached [pid 651] <... set_robust_list resumed>) = 0 [pid 650] <... chdir resumed>) = 0 [pid 649] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 648] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 647] <... write resumed>) = 262144 [pid 645] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 645] <... futex resumed>) = 0 [pid 644] <... futex resumed>) = 0 [pid 639] exit_group(0 [pid 638] exit_group(0 [pid 648] <... futex resumed>) = 1 [pid 646] set_robust_list(0x7f35deb1e9e0, 24 [pid 651] chdir("./13" [pid 650] <... prctl resumed>) = 0 [pid 649] <... mount resumed>) = 0 [pid 648] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 647] munmap(0x7f35d66dd000, 262144 [pid 646] <... set_robust_list resumed>) = 0 [pid 645] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 644] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 643] <... futex resumed>) = ? [pid 642] <... futex resumed>) = ? [pid 641] <... futex resumed>) = ? [pid 640] <... futex resumed>) = ? [pid 639] <... exit_group resumed>) = ? [pid 638] <... exit_group resumed>) = ? [pid 651] <... chdir resumed>) = 0 [pid 650] setpgid(0, 0 [pid 649] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 648] <... mount resumed>) = 0 [pid 647] <... munmap resumed>) = 0 [pid 646] memfd_create("syzkaller", 0 [pid 645] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 644] <... futex resumed>) = 0 [pid 643] +++ exited with 0 +++ [pid 642] +++ exited with 0 +++ [pid 641] +++ exited with 0 +++ [pid 640] +++ exited with 0 +++ [pid 651] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 649] <... futex resumed>) = 0 [pid 647] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 645] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 651] <... prctl resumed>) = 0 [pid 649] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 647] <... openat resumed>) = 5 [pid 645] <... futex resumed>) = 0 [pid 651] setpgid(0, 0 [pid 649] <... open resumed>) = 6 [pid 647] ioctl(5, LOOP_SET_FD, 3 [ 27.747292][ T642] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [pid 645] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 651] <... setpgid resumed>) = 0 [pid 650] <... setpgid resumed>) = 0 [pid 649] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 648] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 646] <... memfd_create resumed>) = 4 [pid 645] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 644] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 650] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 648] <... futex resumed>) = 0 [pid 646] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 644] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 650] <... openat resumed>) = 3 [pid 648] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 646] <... mmap resumed>) = 0x7f35d66dd000 [pid 644] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] write(3, "1000", 4 [pid 648] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 646] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 644] <... futex resumed>) = 0 [pid 650] <... write resumed>) = 4 [pid 648] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 646] <... write resumed>) = 262144 [pid 644] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 650] close(3 [pid 648] <... open resumed>) = 5 [pid 646] munmap(0x7f35d66dd000, 262144 [pid 650] <... close resumed>) = 0 [pid 648] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 646] <... munmap resumed>) = 0 [pid 650] symlink("/dev/binderfs", "./binderfs" [pid 648] <... futex resumed>) = 1 [pid 646] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 644] <... futex resumed>) = 0 [pid 650] <... symlink resumed>) = 0 [pid 648] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 646] <... openat resumed>) = 6 [pid 644] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 648] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 646] ioctl(6, LOOP_SET_FD, 4 [pid 644] <... futex resumed>) = 0 [pid 651] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 650] <... futex resumed>) = 0 [pid 649] <... futex resumed>) = 0 [pid 648] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 647] <... ioctl resumed>) = 0 [pid 645] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 644] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 651] <... openat resumed>) = 3 [pid 649] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 647] close(3 [pid 645] <... futex resumed>) = 0 [pid 651] write(3, "1000", 4 [pid 649] <... write resumed>) = 262144 [pid 647] <... close resumed>) = 0 [pid 645] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 651] <... write resumed>) = 4 [pid 649] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 647] mkdir("./file1", 0777 [pid 651] close(3 [pid 649] <... futex resumed>) = 1 [pid 647] <... mkdir resumed>) = 0 [pid 645] <... futex resumed>) = 0 [pid 651] <... close resumed>) = 0 [pid 649] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 647] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 651] symlink("/dev/binderfs", "./binderfs" [pid 650] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 651] <... symlink resumed>) = 0 [pid 651] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 651] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 651] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 651] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[652], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 652 [pid 651] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 651] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 651] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 651] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 651] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[653], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 653 [pid 651] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 651] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 652 attached [pid 652] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 652] memfd_create("syzkaller", 0) = 3 [pid 652] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 652] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 652] munmap(0x7f35d66dd000, 262144) = 0 [pid 652] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 652] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 653 attached [pid 650] <... mmap resumed>) = 0x7f35deafe000 [pid 646] <... ioctl resumed>) = 0 [pid 647] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 647] ioctl(5, LOOP_CLR_FD) = 0 [pid 647] close(5) = 0 [pid 647] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 645] exit_group(0 [pid 649] <... futex resumed>) = ? [pid 645] <... exit_group resumed>) = ? [pid 649] +++ exited with 0 +++ [pid 647] <... futex resumed>) = ? [pid 652] <... ioctl resumed>) = 0 [pid 652] close(3) = 0 [pid 652] mkdir("./file1", 0777) = 0 [ 27.779491][ T647] loop4: detected capacity change from 0 to 512 [ 27.784273][ T646] loop5: detected capacity change from 0 to 512 [ 27.793995][ T647] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 27.794272][ T648] blk_update_request: I/O error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 27.811435][ T652] loop0: detected capacity change from 0 to 512 [ 27.811899][ T648] Buffer I/O error on dev loop5, logical block 0, lost async page write [pid 652] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 653] set_robust_list(0x7f35deafd9e0, 24 [pid 650] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 646] close(4 [pid 639] +++ exited with 0 +++ [pid 638] +++ exited with 0 +++ [pid 653] <... set_robust_list resumed>) = 0 [pid 650] <... mprotect resumed>) = 0 [pid 646] <... close resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=638, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=639, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 653] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 650] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 646] mkdir("./file1", 0777 [pid 653] <... open resumed>) = 3 [pid 646] <... mkdir resumed>) = 0 [pid 653] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] <... clone resumed>, parent_tid=[654], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 654 [pid 646] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 298] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 653] <... futex resumed>) = 1 [pid 650] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 653] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 650] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 650] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 650] <... futex resumed>) = 0 [pid 298] fstat(3, [pid 297] fstat(3, [pid 650] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 650] <... mmap resumed>) = 0x7f35deadd000 [pid 298] getdents64(3, [pid 297] getdents64(3, [pid 650] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 650] <... mprotect resumed>) = 0 [pid 298] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 650] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[655], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 655 [pid 650] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 650] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 644] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 298] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 298] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 651] <... futex resumed>) = 0 [pid 298] lstat("./14/bus", [pid 297] lstat("./14/bus", [pid 651] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] unlink("./14/bus" [pid 297] unlink("./14/bus" [pid 653] <... futex resumed>) = 0 [pid 651] <... futex resumed>) = 1 [pid 298] <... unlink resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 653] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 651] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 653] <... mount resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 653] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] lstat("./14/binderfs", [pid 297] lstat("./14/binderfs", [pid 653] <... futex resumed>) = 1 [pid 651] <... futex resumed>) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 653] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] unlink("./14/binderfs" [pid 297] unlink("./14/binderfs" [pid 298] <... unlink resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 298] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./14/file1", [pid 297] lstat("./14/file1", [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... openat resumed>) = 4 [pid 297] <... openat resumed>) = 4 [pid 298] fstat(4, [pid 297] fstat(4, [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(4, [pid 297] getdents64(4, [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, [pid 297] getdents64(4, [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] close(4 [pid 297] close(4 [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 298] rmdir("./14/file1" [pid 297] rmdir("./14/file1" [pid 298] <... rmdir resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 298] getdents64(3, [pid 297] getdents64(3, [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3 [pid 297] close(3 [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 298] rmdir("./14" [pid 297] rmdir("./14" [pid 298] <... rmdir resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 298] mkdir("./15", 0777 [pid 297] mkdir("./15", 0777 [pid 298] <... mkdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 298] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] ioctl(3, LOOP_CLR_FD [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 297] close(3 [pid 648] <... write resumed>) = -1 EIO (Input/output error) [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 648] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 648] <... futex resumed>) = 0 [pid 648] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 656 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 657 ./strace-static-x86_64: Process 656 attached [pid 656] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 656] chdir("./15") = 0 [pid 656] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 656] setpgid(0, 0) = 0 [pid 656] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 656] write(3, "1000", 4) = 4 [pid 656] close(3) = 0 [pid 656] symlink("/dev/binderfs", "./binderfs") = 0 [pid 656] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 656] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 656] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[658], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 658 [pid 656] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 656] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 656] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[659], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 659 [pid 656] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 659 attached [pid 659] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 659] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 659] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] <... futex resumed>) = 0 [pid 656] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 659] <... futex resumed>) = 1 [pid 659] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 659] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] <... futex resumed>) = 0 [pid 656] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 659] <... futex resumed>) = 1 [pid 659] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 659] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] <... futex resumed>) = 0 [pid 656] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 659] <... futex resumed>) = 1 [pid 659] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 659] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] <... futex resumed>) = 0 [pid 659] <... futex resumed>) = 1 [pid 659] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 658 attached [pid 658] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 658] memfd_create("syzkaller", 0) = 5 [pid 658] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 658] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 651] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 653] <... futex resumed>) = 0 [pid 651] <... futex resumed>) = 1 [pid 651] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 653] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 653] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 657 attached ./strace-static-x86_64: Process 655 attached ./strace-static-x86_64: Process 654 attached ) = 1 [pid 653] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 657] set_robust_list(0x555556c9c5e0, 24 [pid 655] set_robust_list(0x7f35deafd9e0, 24 [pid 654] set_robust_list(0x7f35deb1e9e0, 24 [pid 651] <... futex resumed>) = 0 [pid 657] <... set_robust_list resumed>) = 0 [pid 655] <... set_robust_list resumed>) = 0 [pid 654] <... set_robust_list resumed>) = 0 [pid 651] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 647] +++ exited with 0 +++ [pid 645] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=645, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 299] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 657] chdir("./15" [pid 655] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 654] memfd_create("syzkaller", 0 [pid 653] <... futex resumed>) = 0 [pid 651] <... futex resumed>) = 1 [pid 299] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 657] <... chdir resumed>) = 0 [pid 655] <... open resumed>) = 3 [pid 654] <... memfd_create resumed>) = 4 [ 27.822796][ T652] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 27.822796][ T652] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.822796][ T652] [ 27.847408][ T646] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 27.847408][ T646] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.847408][ T646] [ 27.868075][ T646] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [pid 653] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 651] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 658] <... write resumed>) = 262144 [pid 657] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 655] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 654] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 299] lstat("./14/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] unlink("./14/bus") = 0 [pid 299] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./14/binderfs") = 0 [pid 299] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./14/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 658] munmap(0x7f35d66dd000, 262144 [pid 657] <... prctl resumed>) = 0 [pid 655] <... futex resumed>) = 1 [pid 654] <... mmap resumed>) = 0x7f35d66dd000 [pid 650] <... futex resumed>) = 0 [pid 646] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 658] <... munmap resumed>) = 0 [pid 657] setpgid(0, 0 [pid 655] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 650] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 653] <... write resumed>) = 262144 [pid 650] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 653] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... openat resumed>) = 4 [pid 654] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 653] <... futex resumed>) = 1 [pid 651] <... futex resumed>) = 0 [pid 299] fstat(4, [pid 653] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./14/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./14" [pid 658] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 657] <... setpgid resumed>) = 0 [pid 655] <... mount resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 299] mkdir("./15", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 660 ./strace-static-x86_64: Process 660 attached [pid 660] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 660] chdir("./15") = 0 [pid 660] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 660] setpgid(0, 0) = 0 [pid 660] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 660] write(3, "1000", 4) = 4 [pid 660] close(3) = 0 [pid 660] symlink("/dev/binderfs", "./binderfs") = 0 [pid 660] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 660] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 660] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 660] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[661], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 661 ./strace-static-x86_64: Process 661 attached [pid 658] <... openat resumed>) = 6 [pid 657] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 655] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 654] <... write resumed>) = 262144 [pid 652] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 646] ioctl(6, LOOP_CLR_FD [pid 660] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 660] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 660] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 660] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 658] ioctl(6, LOOP_SET_FD, 5 [pid 657] <... openat resumed>) = 3 [pid 655] <... futex resumed>) = 1 [pid 650] <... futex resumed>) = 0 [pid 660] <... mprotect resumed>) = 0 [pid 660] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 650] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 660] <... clone resumed>, parent_tid=[662], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 662 [pid 660] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 660] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 661] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 661] memfd_create("syzkaller", 0) = 3 [pid 661] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 661] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 661] munmap(0x7f35d66dd000, 262144) = 0 [pid 655] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 650] <... futex resumed>) = 0 [pid 657] write(3, "1000", 4 [pid 661] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 661] ioctl(4, LOOP_SET_FD, 3 [pid 657] <... write resumed>) = 4 [pid 655] <... open resumed>) = 5 [pid 654] munmap(0x7f35d66dd000, 262144 [pid 650] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 657] close(3) = 0 [pid 655] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 654] <... munmap resumed>) = 0 [pid 657] symlink("/dev/binderfs", "./binderfs" [pid 655] <... futex resumed>) = 1 [pid 654] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 650] <... futex resumed>) = 0 [pid 657] <... symlink resumed>) = 0 [pid 657] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 654] <... openat resumed>) = 6 [pid 650] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 657] <... futex resumed>) = 0 [pid 657] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 655] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 654] ioctl(6, LOOP_SET_FD, 4 [pid 650] <... futex resumed>) = 0 [pid 657] <... mmap resumed>) = 0x7f35deafe000 [pid 655] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 650] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 657] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 655] <... futex resumed>) = 0 [pid 650] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 657] <... mprotect resumed>) = 0 [pid 655] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 657] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 663 attached [pid 658] <... ioctl resumed>) = 0 [pid 654] <... ioctl resumed>) = 0 [ 27.882538][ T646] EXT4-fs (loop5): group descriptors corrupted! [ 27.893660][ T652] EXT4-fs (loop0): Magic mismatch, very weird! [ 27.912010][ T658] loop3: detected capacity change from 0 to 512 [ 27.921360][ T654] loop1: detected capacity change from 0 to 512 [pid 652] ioctl(4, LOOP_CLR_FD [pid 646] <... ioctl resumed>) = 0 [pid 657] <... clone resumed>, parent_tid=[663], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 663 [pid 646] close(6 [pid 657] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 646] <... close resumed>) = 0 ./strace-static-x86_64: Process 662 attached [pid 662] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 662] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 657] <... futex resumed>) = 0 [pid 646] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 657] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 646] <... futex resumed>) = 0 [pid 657] <... futex resumed>) = 0 [pid 646] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 657] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 644] exit_group(0 [pid 657] <... mmap resumed>) = 0x7f35deadd000 [pid 648] <... futex resumed>) = ? [pid 646] <... futex resumed>) = ? [pid 644] <... exit_group resumed>) = ? [pid 663] set_robust_list(0x7f35deb1e9e0, 24 [pid 658] close(5 [pid 657] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 654] close(4 [pid 652] <... ioctl resumed>) = 0 [pid 648] +++ exited with 0 +++ [pid 657] <... mprotect resumed>) = 0 [pid 657] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 662] <... open resumed>) = 5 [pid 662] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 660] <... futex resumed>) = 0 [pid 657] <... clone resumed>, parent_tid=[664], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 664 [pid 660] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 657] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 660] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 662] <... futex resumed>) = 1 [pid 662] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 657] <... futex resumed>) = 0 [pid 657] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 662] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 660] <... futex resumed>) = 0 [pid 660] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 660] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 662] <... futex resumed>) = 1 [pid 662] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c./strace-static-x86_64: Process 664 attached [pid 664] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 664] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 664] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 657] <... futex resumed>) = 0 [pid 664] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 657] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 664] <... mount resumed>) = 0 [pid 663] <... set_robust_list resumed>) = 0 [pid 658] <... close resumed>) = 0 [pid 657] <... futex resumed>) = 0 [pid 654] <... close resumed>) = 0 [pid 652] close(4 [pid 657] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] <... close resumed>) = 0 [pid 664] <... futex resumed>) = 1 [pid 657] <... futex resumed>) = 0 [pid 664] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 663] memfd_create("syzkaller", 0 [pid 658] mkdir("./file1", 0777 [pid 657] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 654] mkdir("./file1", 0777 [pid 652] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 657] <... futex resumed>) = 0 [pid 652] <... futex resumed>) = 0 [pid 657] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 652] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 658] <... mkdir resumed>) = 0 [pid 651] exit_group(0 [pid 664] <... open resumed>) = 4 [pid 653] <... futex resumed>) = ? [pid 658] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 652] <... futex resumed>) = ? [pid 651] <... exit_group resumed>) = ? [pid 664] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 663] <... memfd_create resumed>) = 5 [pid 654] <... mkdir resumed>) = 0 [pid 653] +++ exited with 0 +++ [pid 664] <... futex resumed>) = 1 [pid 657] <... futex resumed>) = 0 [pid 664] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 657] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 664] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 657] <... futex resumed>) = 0 [pid 664] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 657] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] <... futex resumed>) = 0 [pid 657] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 664] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 662] <... open resumed>) = 6 [pid 662] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 660] <... futex resumed>) = 0 [pid 662] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 660] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 660] <... futex resumed>) = 0 [pid 662] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 660] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 661] <... ioctl resumed>) = 0 [pid 661] close(3) = 0 [pid 661] mkdir("./file1", 0777) = 0 [pid 661] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 663] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 663] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 663] munmap(0x7f35d66dd000, 262144) = 0 [pid 663] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 6 [pid 663] ioctl(6, LOOP_SET_FD, 5) = 0 [ 27.921392][ T661] loop4: detected capacity change from 0 to 512 [ 27.947564][ T658] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 27.947564][ T658] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.947564][ T658] [ 27.957054][ T663] loop2: detected capacity change from 0 to 512 [ 27.973037][ T654] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [pid 654] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 662] <... write resumed>) = 262144 [pid 652] +++ exited with 0 +++ [pid 651] +++ exited with 0 +++ [pid 646] +++ exited with 0 +++ [pid 644] +++ exited with 0 +++ [pid 663] close(5) = 0 [pid 663] mkdir("./file1", 0777) = 0 [pid 663] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 662] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 660] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=644, si_uid=0, si_status=0, si_utime=0, si_stime=9} --- [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=651, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 662] <... futex resumed>) = 0 [pid 661] ioctl(4, LOOP_CLR_FD [pid 662] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 661] <... ioctl resumed>) = 0 [pid 661] close(4) = 0 [pid 661] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 660] exit_group(0) = ? [pid 662] <... futex resumed>) = -1 (errno 18446744073709551555) [pid 662] +++ exited with 0 +++ [pid 661] <... futex resumed>) = ? [pid 295] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 661] +++ exited with 0 +++ [pid 660] +++ exited with 0 +++ [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=660, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] <... openat resumed>) = 3 [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 295] <... openat resumed>) = 3 [pid 300] fstat(3, [pid 295] fstat(3, [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] <... restart_syscall resumed>) = 0 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(3, [pid 295] getdents64(3, [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [ 27.973037][ T654] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.973037][ T654] [ 27.976192][ T661] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 27.994234][ T663] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 27.994234][ T663] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 27.994234][ T663] [pid 295] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = 0 [pid 300] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./12/bus", [pid 295] lstat("./13/bus", [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] unlink("./12/bus" [pid 295] unlink("./13/bus" [pid 300] <... unlink resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 300] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./12/binderfs", [pid 295] lstat("./13/binderfs", [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] unlink("./12/binderfs" [pid 295] unlink("./13/binderfs" [pid 300] <... unlink resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 300] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./12/file1", [pid 295] lstat("./13/file1", [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] <... openat resumed>) = 4 [pid 295] <... openat resumed>) = 4 [pid 300] fstat(4, [pid 295] fstat(4, [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(4, [pid 295] getdents64(4, [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] getdents64(4, [pid 295] getdents64(4, [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] close(4 [pid 295] close(4 [pid 300] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 300] rmdir("./12/file1" [pid 295] rmdir("./13/file1" [pid 300] <... rmdir resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 300] getdents64(3, [pid 295] getdents64(3, [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] close(3 [pid 295] close(3 [pid 300] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 300] rmdir("./12" [pid 295] rmdir("./13" [pid 300] <... rmdir resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 300] mkdir("./13", 0777 [pid 295] mkdir("./14", 0777 [pid 300] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 300] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 300] ioctl(3, LOOP_CLR_FD [pid 295] ioctl(3, LOOP_CLR_FD [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] close(3 [pid 295] close(3 [pid 300] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 669 [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 670 ./strace-static-x86_64: Process 670 attached [pid 670] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 670] chdir("./14") = 0 [pid 670] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 670] setpgid(0, 0) = 0 [pid 670] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 670] write(3, "1000", 4) = 4 [pid 670] close(3) = 0 [pid 670] symlink("/dev/binderfs", "./binderfs") = 0 [pid 670] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 670] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 670] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [ 28.036580][ T658] EXT4-fs (loop3): 1 orphan inode deleted [ 28.037930][ T654] EXT4-fs (loop1): 1 orphan inode deleted [ 28.042127][ T658] EXT4-fs (loop3): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [pid 670] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 669 attached [pid 669] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 669] chdir("./13" [pid 670] <... clone resumed>, parent_tid=[671], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 671 [pid 670] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 670] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 670] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 669] <... chdir resumed>) = 0 [pid 670] <... mmap resumed>) = 0x7f35deadd000 [pid 670] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 669] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 669] setpgid(0, 0 [pid 670] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 669] <... setpgid resumed>) = 0 [pid 669] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 670] <... clone resumed>, parent_tid=[672], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 672 [pid 670] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 669] <... openat resumed>) = 3 [pid 670] <... futex resumed>) = 0 [pid 670] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 669] write(3, "1000", 4) = 4 [pid 669] close(3) = 0 [pid 669] symlink("/dev/binderfs", "./binderfs") = 0 [pid 669] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 669] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 669] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 669] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[673], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 673 [pid 669] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 669] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 669] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 669] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 299] <... openat resumed>) = 3 [pid 669] <... mprotect resumed>) = 0 [pid 669] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[675], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 675 [pid 669] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 669] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 672 attached [pid 672] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 672] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 672] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 670] <... futex resumed>) = 0 [pid 670] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 670] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 672] <... futex resumed>) = 1 [pid 672] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 ./strace-static-x86_64: Process 675 attached [pid 675] set_robust_list(0x7f35deafd9e0, 24) = 0 ./strace-static-x86_64: Process 671 attached ./strace-static-x86_64: Process 673 attached [pid 675] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 672] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] fstat(3, [pid 675] <... open resumed>) = 3 [pid 673] set_robust_list(0x7f35deb1e9e0, 24 [pid 672] <... futex resumed>) = 1 [pid 671] set_robust_list(0x7f35deb1e9e0, 24 [pid 670] <... futex resumed>) = 0 [pid 675] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 673] <... set_robust_list resumed>) = 0 [pid 672] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 671] <... set_robust_list resumed>) = 0 [pid 670] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 675] <... futex resumed>) = 1 [pid 673] memfd_create("syzkaller", 0 [pid 672] <... open resumed>) = 4 [pid 671] memfd_create("syzkaller", 0 [pid 670] <... futex resumed>) = 0 [pid 669] <... futex resumed>) = 0 [pid 675] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 673] <... memfd_create resumed>) = 4 [pid 672] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 671] <... memfd_create resumed>) = 5 [pid 670] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 669] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 675] <... mount resumed>) = 0 [pid 673] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 672] <... futex resumed>) = 0 [pid 671] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 670] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 669] <... futex resumed>) = 0 [pid 675] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 673] <... mmap resumed>) = 0x7f35d66dd000 [pid 672] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 671] <... mmap resumed>) = 0x7f35d66dd000 [pid 670] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 669] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 675] <... futex resumed>) = 0 [pid 673] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 672] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 671] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 670] <... futex resumed>) = 0 [pid 669] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 675] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 672] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 670] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 669] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 675] <... open resumed>) = 5 [pid 672] <... futex resumed>) = 0 [pid 670] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 669] <... futex resumed>) = 0 [pid 675] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 672] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 669] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 675] <... futex resumed>) = 0 [pid 673] <... write resumed>) = 262144 [pid 669] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 675] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 669] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 675] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 671] <... write resumed>) = 262144 [pid 669] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 675] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [ 28.047765][ T654] EXT4-fs (loop1): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 28.102829][ T658] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/15/file1 supports timestamps until 2038 (0x7fffffff) [ 28.115742][ T654] ext4 filesystem being mounted at /root/syzkaller.5s3MMz/12/file1 supports timestamps until 2038 (0x7fffffff) [ 28.128739][ T673] loop5: detected capacity change from 0 to 512 [pid 671] munmap(0x7f35d66dd000, 262144 [pid 299] getdents64(3, [pid 675] <... futex resumed>) = 1 [pid 673] munmap(0x7f35d66dd000, 262144 [pid 669] <... futex resumed>) = 0 [pid 658] <... mount resumed>) = 0 [pid 654] <... mount resumed>) = 0 [pid 673] <... munmap resumed>) = 0 [pid 654] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 673] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 654] <... openat resumed>) = 4 [pid 673] <... openat resumed>) = 6 [pid 654] chdir("./file1" [pid 299] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 673] ioctl(6, LOOP_SET_FD, 4 [pid 654] <... chdir resumed>) = 0 [pid 675] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 654] ioctl(6, LOOP_CLR_FD [pid 673] <... ioctl resumed>) = 0 [pid 654] <... ioctl resumed>) = 0 [pid 673] close(4 [pid 654] close(6 [pid 673] <... close resumed>) = 0 [pid 654] <... close resumed>) = 0 [pid 673] mkdir("./file1", 0777 [pid 654] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 673] <... mkdir resumed>) = 0 [pid 654] <... futex resumed>) = 0 [pid 654] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 673] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 658] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 658] chdir("./file1") = 0 [pid 658] ioctl(6, LOOP_CLR_FD) = 0 [pid 658] close(6) = 0 [pid 658] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 658] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 671] <... munmap resumed>) = 0 [pid 671] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 671] ioctl(6, LOOP_SET_FD, 5 [pid 656] exit_group(0 [pid 650] exit_group(0 [pid 299] <... umount2 resumed>) = 0 [pid 671] <... ioctl resumed>) = 0 [pid 671] close(5) = 0 [pid 671] mkdir("./file1", 0777) = 0 [ 28.129638][ T663] EXT4-fs (loop2): 1 orphan inode deleted [ 28.137029][ T671] loop0: detected capacity change from 0 to 512 [ 28.148214][ T663] EXT4-fs (loop2): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 28.149234][ T673] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 28.149234][ T673] Contact linux-ext4@vger.kernel.org if you think we should keep it. [pid 671] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 663] <... mount resumed>) = 0 [pid 659] <... futex resumed>) = ? [pid 658] <... futex resumed>) = ? [pid 656] <... exit_group resumed>) = ? [pid 655] <... futex resumed>) = ? [pid 654] <... futex resumed>) = ? [pid 650] <... exit_group resumed>) = ? [pid 299] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 663] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 659] +++ exited with 0 +++ [pid 658] +++ exited with 0 +++ [pid 656] +++ exited with 0 +++ [pid 655] +++ exited with 0 +++ [pid 654] +++ exited with 0 +++ [pid 650] +++ exited with 0 +++ [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] lstat("./15/bus", [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=656, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=650, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 299] unlink("./15/bus" [pid 296] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... unlink resumed>) = 0 [pid 298] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... openat resumed>) = 3 [pid 299] lstat("./15/binderfs", [pid 298] <... openat resumed>) = 3 [pid 296] fstat(3, [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] fstat(3, [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] unlink("./15/binderfs" [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, [pid 299] <... unlink resumed>) = 0 [pid 298] getdents64(3, [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 299] lstat("./15/file1", [pid 298] <... umount2 resumed>) = 0 [pid 296] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 663] <... openat resumed>) = 5 [pid 663] chdir("./file1" [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./12/bus", [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./15/bus", [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] unlink("./12/bus" [pid 663] <... chdir resumed>) = 0 [pid 299] <... openat resumed>) = 4 [pid 298] unlink("./15/bus" [pid 296] <... unlink resumed>) = 0 [pid 663] ioctl(6, LOOP_CLR_FD [pid 299] fstat(4, [pid 298] <... unlink resumed>) = 0 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 663] <... ioctl resumed>) = 0 [pid 299] getdents64(4, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] lstat("./15/binderfs", [pid 296] lstat("./12/binderfs", [pid 299] getdents64(4, [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] unlink("./15/binderfs" [pid 296] unlink("./12/binderfs" [pid 663] close(6 [pid 299] close(4 [pid 298] <... unlink resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 663] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 663] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] rmdir("./15/file1" [pid 663] <... futex resumed>) = 0 [pid 657] exit_group(0 [pid 664] <... futex resumed>) = ? [pid 657] <... exit_group resumed>) = ? [pid 664] +++ exited with 0 +++ [pid 663] +++ exited with 0 +++ [pid 657] +++ exited with 0 +++ [pid 299] <... rmdir resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=657, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 299] close(3 [pid 298] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... close resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] rmdir("./15" [pid 298] lstat("./15/file1", [pid 297] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... rmdir resumed>) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... openat resumed>) = 3 [pid 299] mkdir("./16", 0777 [pid 298] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] fstat(3, [pid 299] <... mkdir resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 298] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] getdents64(3, [pid 299] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 4 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] fstat(4, [pid 297] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] close(3 [pid 298] getdents64(4, [pid 297] <... umount2 resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [ 28.149234][ T673] [ 28.171506][ T663] ext4 filesystem being mounted at /root/syzkaller.7ngmbG/15/file1 supports timestamps until 2038 (0x7fffffff) [ 28.189240][ T671] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 28.189240][ T671] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.189240][ T671] [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 681 [pid 298] close(4) = 0 [pid 298] rmdir("./15/file1") = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./15") = 0 [pid 298] mkdir("./16", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 28.239611][ T673] EXT4-fs (loop5): 1 orphan inode deleted [ 28.241159][ T671] EXT4-fs (loop0): 1 orphan inode deleted [ 28.250680][ T673] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. ./strace-static-x86_64: Process 681 attached [pid 297] lstat("./15/bus", [pid 681] set_robust_list(0x555556c9c5e0, 24 [pid 673] <... mount resumed>) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 681] <... set_robust_list resumed>) = 0 [pid 297] unlink("./15/bus" [pid 681] chdir("./16" [pid 297] <... unlink resumed>) = 0 [pid 681] <... chdir resumed>) = 0 [pid 297] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 681] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 681] <... prctl resumed>) = 0 [pid 297] lstat("./15/binderfs", [pid 681] setpgid(0, 0 [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 681] <... setpgid resumed>) = 0 [pid 297] unlink("./15/binderfs" [pid 681] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... unlink resumed>) = 0 [pid 681] <... openat resumed>) = 3 [pid 297] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 681] write(3, "1000", 4) = 4 [pid 681] close(3) = 0 [pid 681] symlink("/dev/binderfs", "./binderfs") = 0 [pid 681] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 681] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 681] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 681] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[682], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 682 [pid 681] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 681] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 681] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 681] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 681] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[683], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 683 [pid 681] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 681] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 673] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 673] chdir("./file1") = 0 [pid 673] ioctl(6, LOOP_CLR_FD) = 0 ./strace-static-x86_64: Process 683 attached ./strace-static-x86_64: Process 682 attached [pid 673] close(6 [pid 671] <... mount resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 296] <... umount2 resumed>) = 0 [pid 671] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 298] ioctl(3, LOOP_CLR_FD [pid 296] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 671] <... openat resumed>) = 5 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 671] chdir("./file1" [pid 298] close(3 [pid 296] lstat("./12/file1", [pid 683] set_robust_list(0x7f35deafd9e0, 24 [pid 682] set_robust_list(0x7f35deb1e9e0, 24 [pid 673] <... close resumed>) = 0 [pid 671] <... chdir resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 682] <... set_robust_list resumed>) = 0 [pid 671] ioctl(6, LOOP_CLR_FD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 682] memfd_create("syzkaller", 0 [pid 671] <... ioctl resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 682] <... memfd_create resumed>) = 3 [pid 671] close(6 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 684 [pid 296] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 682] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 671] <... close resumed>) = 0 [pid 296] <... openat resumed>) = 4 [pid 682] <... mmap resumed>) = 0x7f35d66dd000 [pid 671] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] fstat(4, [pid 682] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 671] <... futex resumed>) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 671] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 670] exit_group(0 [pid 296] getdents64(4, [pid 672] <... futex resumed>) = ? [pid 671] <... futex resumed>) = ? [pid 670] <... exit_group resumed>) = ? [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 672] +++ exited with 0 +++ [pid 671] +++ exited with 0 +++ [pid 670] +++ exited with 0 +++ [pid 296] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=670, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 296] close(4) = 0 [pid 296] rmdir("./12/file1") = 0 [pid 296] getdents64(3, [pid 295] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] close(3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./12" [pid 295] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./13", 0777 [pid 295] <... openat resumed>) = 3 [pid 296] <... mkdir resumed>) = 0 [pid 295] fstat(3, [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 682] <... write resumed>) = 262144 [pid 296] <... openat resumed>) = 3 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 683] <... set_robust_list resumed>) = 0 [pid 673] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] getdents64(3, [pid 683] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 682] munmap(0x7f35d66dd000, 262144 [pid 673] <... futex resumed>) = 0 [pid 669] exit_group(0 [pid 296] close(3 [pid 683] <... open resumed>) = 4 [pid 682] <... munmap resumed>) = 0 [pid 675] <... futex resumed>) = ? [pid 669] <... exit_group resumed>) = ? [pid 296] <... close resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 683] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 682] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 675] +++ exited with 0 +++ [pid 673] +++ exited with 0 +++ [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 683] <... futex resumed>) = 1 [pid 682] <... openat resumed>) = 5 [pid 669] +++ exited with 0 +++ [pid 683] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 682] ioctl(5, LOOP_SET_FD, 3 [pid 681] <... futex resumed>) = 0 [ 28.255419][ T671] EXT4-fs (loop0): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 28.274549][ T673] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/13/file1 supports timestamps until 2038 (0x7fffffff) [ 28.299647][ T671] ext4 filesystem being mounted at /root/syzkaller.d28Auw/14/file1 supports timestamps until 2038 (0x7fffffff) [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 685 [pid 295] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 683] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 681] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=669, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 683] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 681] <... futex resumed>) = 0 [pid 300] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 683] <... mount resumed>) = 0 [pid 681] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 683] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 683] <... futex resumed>) = 1 [pid 300] <... openat resumed>) = 3 [pid 681] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 683] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 681] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] fstat(3, [pid 295] lstat("./14/bus", [pid 681] <... futex resumed>) = 0 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 681] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] getdents64(3, [pid 295] unlink("./14/bus"./strace-static-x86_64: Process 684 attached [pid 683] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 682] <... ioctl resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 683] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 6 [pid 295] <... unlink resumed>) = 0 [pid 300] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 683] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 683] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 682] close(3) = 0 [pid 682] mkdir("./file1", 0777 [pid 681] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 681] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = 0 [pid 295] lstat("./14/binderfs", [pid 683] <... futex resumed>) = 0 [pid 681] <... futex resumed>) = 1 [pid 300] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 683] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 681] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 682] <... mkdir resumed>) = 0 [pid 682] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 684] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 684] chdir("./16") = 0 [pid 684] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 684] setpgid(0, 0) = 0 [pid 684] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 684] write(3, "1000", 4) = 4 [pid 684] close(3) = 0 [pid 684] symlink("/dev/binderfs", "./binderfs") = 0 [pid 684] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 684] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 684] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 684] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 300] lstat("./13/bus", [pid 295] unlink("./14/binderfs" [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] <... unlink resumed>) = 0 [pid 683] <... write resumed>) = 262144 [pid 300] unlink("./13/bus" [pid 295] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 684] <... clone resumed>, parent_tid=[686], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 686 [pid 300] <... unlink resumed>) = 0 [pid 683] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 684] <... futex resumed>) = 0 [pid 684] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 684] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 684] <... mmap resumed>) = 0x7f35deadd000 [pid 684] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 300] lstat("./13/binderfs", [pid 684] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] unlink("./13/binderfs" [pid 684] <... clone resumed>, parent_tid=[687], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 687 [pid 684] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 684] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 685 attached [pid 300] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 685] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 685] chdir("./13") = 0 [pid 685] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 685] setpgid(0, 0) = 0 [pid 685] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 685] write(3, "1000", 4) = 4 [pid 685] close(3) = 0 [pid 685] symlink("/dev/binderfs", "./binderfs") = 0 [pid 685] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 685] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 685] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 683] <... futex resumed>) = 1 [pid 681] <... futex resumed>) = 0 [pid 683] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 685] <... clone resumed>, parent_tid=[688], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 688 [pid 685] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 685] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 685] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[689], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 689 [pid 685] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 689 attached [pid 689] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 689] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 689] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 685] <... futex resumed>) = 0 [pid 685] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 689] <... futex resumed>) = 1 [pid 689] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 689] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 685] <... futex resumed>) = 0 [pid 685] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 689] <... futex resumed>) = 1 [pid 689] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 689] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 685] <... futex resumed>) = 0 [pid 685] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 685] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 689] <... futex resumed>) = 1 [pid 689] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 689] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 685] <... futex resumed>) = 0 [pid 689] <... futex resumed>) = 1 [pid 689] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 688 attached [pid 688] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 688] memfd_create("syzkaller", 0) = 5 [pid 688] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 688] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 688] munmap(0x7f35d66dd000, 262144) = 0 [pid 688] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 6 [pid 688] ioctl(6, LOOP_SET_FD, 5./strace-static-x86_64: Process 687 attached ./strace-static-x86_64: Process 686 attached [pid 682] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 687] set_robust_list(0x7f35deafd9e0, 24 [pid 686] set_robust_list(0x7f35deb1e9e0, 24 [pid 687] <... set_robust_list resumed>) = 0 [pid 686] <... set_robust_list resumed>) = 0 [pid 687] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 686] memfd_create("syzkaller", 0 [pid 687] <... open resumed>) = 3 [pid 686] <... memfd_create resumed>) = 4 [pid 686] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 687] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 687] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 682] ioctl(5, LOOP_CLR_FD [pid 684] <... futex resumed>) = 0 [pid 684] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 686] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 684] <... futex resumed>) = 1 [pid 688] <... ioctl resumed>) = 0 [pid 687] <... futex resumed>) = 0 [pid 687] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 687] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 687] <... futex resumed>) = 0 [pid 687] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 682] <... ioctl resumed>) = 0 [pid 682] close(5 [pid 684] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 684] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 687] <... futex resumed>) = 0 [pid 687] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 684] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 687] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] <... futex resumed>) = 0 [pid 687] <... futex resumed>) = 1 [pid 684] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 687] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 684] <... futex resumed>) = 0 [pid 687] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 684] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 687] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 684] <... futex resumed>) = 0 [pid 687] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 682] <... close resumed>) = 0 [pid 682] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 682] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 688] close(5) = 0 [pid 688] mkdir("./file1", 0777 [pid 686] <... write resumed>) = 262144 [pid 686] munmap(0x7f35d66dd000, 262144) = 0 [pid 686] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 681] exit_group(0 [pid 683] <... futex resumed>) = ? [pid 681] <... exit_group resumed>) = ? [pid 688] <... mkdir resumed>) = 0 [pid 686] <... openat resumed>) = 6 [pid 683] +++ exited with 0 +++ [pid 682] <... futex resumed>) = ? [pid 686] ioctl(6, LOOP_SET_FD, 4 [pid 688] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 686] <... ioctl resumed>) = 0 [pid 686] close(4) = 0 [pid 686] mkdir("./file1", 0777) = 0 [ 28.337548][ T682] loop4: detected capacity change from 0 to 512 [ 28.355008][ T682] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 28.361176][ T688] loop1: detected capacity change from 0 to 512 [ 28.371788][ T686] loop3: detected capacity change from 0 to 512 [ 28.378871][ T688] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [pid 686] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 295] <... umount2 resumed>) = 0 [pid 295] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] lstat("./14/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./14/file1") = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./14") = 0 [pid 295] mkdir("./15", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] <... umount2 resumed>) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 691 ./strace-static-x86_64: Process 691 attached [pid 691] set_robust_list(0x555556c9c5e0, 24 [pid 682] +++ exited with 0 +++ [pid 681] +++ exited with 0 +++ [pid 300] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./13/file1", [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=681, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] lstat("./15/file1", [pid 300] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... restart_syscall resumed>) = 0 [pid 297] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... openat resumed>) = 4 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] fstat(4, [pid 297] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... openat resumed>) = 4 [pid 300] getdents64(4, [pid 297] fstat(4, [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] getdents64(4, [pid 300] close(4) = 0 [pid 299] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] rmdir("./13/file1" [pid 297] getdents64(4, [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... rmdir resumed>) = 0 [pid 299] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] getdents64(3, [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] <... openat resumed>) = 3 [pid 297] close(4 [pid 300] close(3 [pid 297] <... close resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 297] rmdir("./15/file1" [pid 300] rmdir("./13" [pid 299] fstat(3, [pid 297] <... rmdir resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, [pid 300] mkdir("./14", 0777 [pid 299] getdents64(3, [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] <... mkdir resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] close(3 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 299] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... close resumed>) = 0 [pid 300] <... openat resumed>) = 3 [pid 299] <... umount2 resumed>) = 0 [pid 297] rmdir("./15" [pid 300] ioctl(3, LOOP_CLR_FD [pid 299] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] lstat("./16/bus", [pid 297] <... rmdir resumed>) = 0 [pid 300] close(3 [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] mkdir("./16", 0777 [pid 300] <... close resumed>) = 0 [pid 299] unlink("./16/bus" [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... unlink resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 299] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 693 [pid 299] lstat("./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] <... openat resumed>) = 3 [pid 299] unlink("./16/binderfs" [pid 297] ioctl(3, LOOP_CLR_FD [pid 299] <... unlink resumed>) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] close(3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... close resumed>) = 0 [pid 299] lstat("./16/file1", [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 299] fstat(4, [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 695 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 ./strace-static-x86_64: Process 693 attached [pid 299] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./16/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./16") = 0 [pid 693] set_robust_list(0x555556c9c5e0, 24 [pid 299] mkdir("./17", 0777 [pid 693] <... set_robust_list resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 693] chdir("./14" [pid 691] <... set_robust_list resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 693] <... chdir resumed>) = 0 [pid 691] chdir("./15" [pid 299] <... openat resumed>) = 3 [pid 693] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 691] <... chdir resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 691] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 691] <... prctl resumed>) = 0 [pid 299] close(3 [pid 691] setpgid(0, 0 [pid 299] <... close resumed>) = 0 [pid 691] <... setpgid resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 691] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 697 [pid 691] write(3, "1000", 4) = 4 [ 28.378871][ T688] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.378871][ T688] [ 28.381198][ T686] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 28.381198][ T686] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.381198][ T686] [pid 691] close(3) = 0 [pid 691] symlink("/dev/binderfs", "./binderfs") = 0 [pid 691] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 691] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 695 attached ) = 0x7f35deafe000 [pid 695] set_robust_list(0x555556c9c5e0, 24 [pid 691] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 695] <... set_robust_list resumed>) = 0 [pid 691] <... mprotect resumed>) = 0 [pid 695] chdir("./16" [pid 691] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 695] <... chdir resumed>) = 0 [pid 695] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 691] <... clone resumed>, parent_tid=[698], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 698 [pid 695] <... prctl resumed>) = 0 [pid 691] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 695] setpgid(0, 0 [pid 691] <... futex resumed>) = 0 [pid 695] <... setpgid resumed>) = 0 [pid 691] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 695] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 691] <... futex resumed>) = 0 [pid 695] <... openat resumed>) = 3 [pid 691] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 695] write(3, "1000", 4 [pid 691] <... mmap resumed>) = 0x7f35deadd000 [pid 695] <... write resumed>) = 4 [pid 691] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 695] close(3 [pid 691] <... mprotect resumed>) = 0 [pid 695] <... close resumed>) = 0 [pid 691] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 697 attached [pid 695] symlink("/dev/binderfs", "./binderfs" [pid 697] set_robust_list(0x555556c9c5e0, 24 [pid 695] <... symlink resumed>) = 0 [pid 691] <... clone resumed>, parent_tid=[699], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 699 [pid 697] <... set_robust_list resumed>) = 0 [pid 695] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] <... prctl resumed>) = 0 [pid 691] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] setpgid(0, 0 [pid 691] <... futex resumed>) = 0 [pid 697] chdir("./17" [pid 695] <... futex resumed>) = 0 [pid 693] <... setpgid resumed>) = 0 [pid 691] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 697] <... chdir resumed>) = 0 [pid 695] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 693] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 697] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 695] <... mmap resumed>) = 0x7f35deafe000 [pid 697] <... prctl resumed>) = 0 [pid 695] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 693] <... openat resumed>) = 3 [pid 697] setpgid(0, 0 [pid 695] <... mprotect resumed>) = 0 [pid 697] <... setpgid resumed>) = 0 [pid 695] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 697] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 695] <... clone resumed>, parent_tid=[700], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 700 [pid 697] write(3, "1000", 4 [pid 695] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 697] <... write resumed>) = 4 [pid 695] <... futex resumed>) = 0 ./strace-static-x86_64: Process 698 attached [pid 697] close(3 [pid 695] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 698] set_robust_list(0x7f35deb1e9e0, 24 [pid 697] <... close resumed>) = 0 [pid 695] <... futex resumed>) = 0 ./strace-static-x86_64: Process 699 attached [pid 698] <... set_robust_list resumed>) = 0 [pid 697] symlink("/dev/binderfs", "./binderfs" [pid 695] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 699] set_robust_list(0x7f35deafd9e0, 24 [pid 698] memfd_create("syzkaller", 0 [pid 697] <... symlink resumed>) = 0 [pid 695] <... mmap resumed>) = 0x7f35deadd000 [pid 699] <... set_robust_list resumed>) = 0 [pid 698] <... memfd_create resumed>) = 3 [pid 697] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 695] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 699] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 698] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 697] <... futex resumed>) = 0 [pid 695] <... mprotect resumed>) = 0 [pid 699] <... open resumed>) = 4 [pid 698] <... mmap resumed>) = 0x7f35d66dd000 [pid 697] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 695] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 699] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 697] <... mmap resumed>) = 0x7f35deafe000 [pid 693] write(3, "1000", 4 [pid 695] <... clone resumed>, parent_tid=[701], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 701 [pid 693] <... write resumed>) = 4 [pid 697] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 695] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] close(3 [pid 697] <... mprotect resumed>) = 0 [pid 695] <... futex resumed>) = 0 [pid 693] <... close resumed>) = 0 [pid 697] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 695] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 700 attached [pid 699] <... futex resumed>) = 1 [pid 693] <... symlink resumed>) = 0 [pid 691] <... futex resumed>) = 0 [pid 697] <... clone resumed>, parent_tid=[702], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 702 [pid 693] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 691] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 697] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] <... futex resumed>) = 0 [pid 691] <... futex resumed>) = 0 [pid 697] <... futex resumed>) = 0 [pid 693] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 691] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 697] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] <... mmap resumed>) = 0x7f35deafe000 [pid 697] <... futex resumed>) = 0 [pid 693] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 697] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 693] <... mprotect resumed>) = 0 [pid 699] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 697] <... mmap resumed>) = 0x7f35deadd000 [pid 693] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 702 attached ./strace-static-x86_64: Process 701 attached [pid 700] set_robust_list(0x7f35deb1e9e0, 24 [pid 699] <... mount resumed>) = 0 [pid 698] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 697] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 699] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 697] <... mprotect resumed>) = 0 [pid 693] <... clone resumed>, parent_tid=[703], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 703 [pid 702] set_robust_list(0x7f35deb1e9e0, 24 [pid 701] set_robust_list(0x7f35deafd9e0, 24 [pid 700] <... set_robust_list resumed>) = 0 [pid 699] <... futex resumed>) = 1 [pid 698] <... write resumed>) = 262144 [pid 697] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 693] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 691] <... futex resumed>) = 0 [pid 702] <... set_robust_list resumed>) = 0 [pid 701] <... set_robust_list resumed>) = 0 [pid 700] memfd_create("syzkaller", 0 [pid 699] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 698] munmap(0x7f35d66dd000, 262144 [pid 693] <... futex resumed>) = 0 [pid 691] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 700] <... memfd_create resumed>) = 3 [pid 699] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 697] <... clone resumed>, parent_tid=[704], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 704 [pid 693] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 691] <... futex resumed>) = 0 [pid 700] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 699] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 697] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] <... futex resumed>) = 0 [pid 691] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 700] <... mmap resumed>) = 0x7f35d66dd000 [pid 699] <... open resumed>) = 5 [pid 697] <... futex resumed>) = 0 [pid 693] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 702] memfd_create("syzkaller", 0 [pid 701] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 700] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 699] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 698] <... munmap resumed>) = 0 [pid 697] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] <... mmap resumed>) = 0x7f35deadd000 [pid 702] <... memfd_create resumed>) = 3 [pid 701] <... open resumed>) = 4 [pid 700] <... write resumed>) = 262144 [pid 699] <... futex resumed>) = 1 [pid 693] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 691] <... futex resumed>) = 0 [pid 702] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 701] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 699] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 693] <... mprotect resumed>) = 0 [pid 691] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 702] <... mmap resumed>) = 0x7f35d66dd000 [pid 701] <... futex resumed>) = 1 [pid 700] munmap(0x7f35d66dd000, 262144 [pid 699] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 698] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 695] <... futex resumed>) = 0 [pid 693] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 691] <... futex resumed>) = 0 ./strace-static-x86_64: Process 704 attached ./strace-static-x86_64: Process 703 attached [pid 702] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 701] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 700] <... munmap resumed>) = 0 [pid 699] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 698] <... openat resumed>) = 6 [pid 695] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 691] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 701] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 699] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 698] ioctl(6, LOOP_SET_FD, 3 [pid 695] <... futex resumed>) = 0 [pid 693] <... clone resumed>, parent_tid=[706], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 706 ./strace-static-x86_64: Process 706 attached [pid 704] set_robust_list(0x7f35deafd9e0, 24 [pid 703] set_robust_list(0x7f35deb1e9e0, 24 [pid 702] <... write resumed>) = 262144 [pid 701] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 700] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 699] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] <... mount resumed>) = 0 [ 28.443071][ T688] EXT4-fs (loop1): 1 orphan inode deleted [ 28.450433][ T688] EXT4-fs (loop1): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 28.474231][ T688] ext4 filesystem being mounted at /root/syzkaller.5s3MMz/13/file1 supports timestamps until 2038 (0x7fffffff) [ 28.485663][ T698] loop0: detected capacity change from 0 to 512 [pid 688] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 706] set_robust_list(0x7f35deafd9e0, 24 [pid 704] <... set_robust_list resumed>) = 0 [pid 703] <... set_robust_list resumed>) = 0 [pid 702] munmap(0x7f35d66dd000, 262144 [pid 700] <... openat resumed>) = 5 [pid 688] <... openat resumed>) = 5 [pid 700] ioctl(5, LOOP_SET_FD, 3 [pid 688] chdir("./file1" [pid 706] <... set_robust_list resumed>) = 0 [pid 704] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 703] memfd_create("syzkaller", 0 [pid 702] <... munmap resumed>) = 0 [pid 701] <... mount resumed>) = 0 [pid 699] <... futex resumed>) = 1 [pid 695] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 691] <... futex resumed>) = 0 [pid 688] <... chdir resumed>) = 0 [pid 688] ioctl(6, LOOP_CLR_FD [pid 706] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 704] <... open resumed>) = 4 [pid 703] <... memfd_create resumed>) = 3 [pid 702] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 688] <... ioctl resumed>) = 0 [pid 688] close(6) = 0 [pid 688] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 688] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 706] <... open resumed>) = 4 [pid 704] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 703] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 702] <... openat resumed>) = 5 [ 28.493374][ T686] EXT4-fs (loop3): 1 orphan inode deleted [ 28.495788][ T700] loop2: detected capacity change from 0 to 512 [ 28.502629][ T686] EXT4-fs (loop3): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 28.510491][ T702] loop4: detected capacity change from 0 to 512 [pid 706] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 704] <... futex resumed>) = 1 [pid 703] <... mmap resumed>) = 0x7f35d66dd000 [pid 702] ioctl(5, LOOP_SET_FD, 3 [pid 706] <... futex resumed>) = 0 [pid 704] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 703] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 701] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 700] <... ioctl resumed>) = 0 [pid 699] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 698] <... ioctl resumed>) = 0 [pid 697] <... futex resumed>) = 0 [pid 693] <... futex resumed>) = 0 [pid 706] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 701] <... futex resumed>) = 1 [pid 700] close(3 [pid 698] close(3 [pid 697] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 685] exit_group(0 [pid 703] <... write resumed>) = 262144 [pid 695] <... futex resumed>) = 0 [pid 704] <... futex resumed>) = 0 [pid 703] munmap(0x7f35d66dd000, 262144 [pid 701] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 700] <... close resumed>) = 0 [pid 698] <... close resumed>) = 0 [pid 697] <... futex resumed>) = 1 [pid 695] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 689] <... futex resumed>) = ? [pid 688] <... futex resumed>) = ? [pid 686] <... mount resumed>) = 0 [pid 685] <... exit_group resumed>) = ? [pid 704] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 703] <... munmap resumed>) = 0 [pid 702] <... ioctl resumed>) = 0 [pid 701] <... open resumed>) = 3 [pid 700] mkdir("./file1", 0777 [pid 698] mkdir("./file1", 0777 [pid 697] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 695] <... futex resumed>) = 0 [pid 693] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 689] +++ exited with 0 +++ [pid 688] +++ exited with 0 +++ [pid 685] +++ exited with 0 +++ [pid 706] <... futex resumed>) = 0 [pid 704] <... mount resumed>) = 0 [pid 703] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 702] close(3 [pid 701] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 700] <... mkdir resumed>) = 0 [pid 698] <... mkdir resumed>) = 0 [pid 695] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] <... futex resumed>) = 1 [pid 706] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 704] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 703] <... openat resumed>) = 5 [pid 702] <... close resumed>) = 0 [pid 701] <... futex resumed>) = 0 [pid 700] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 698] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 695] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 693] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=685, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 706] <... mount resumed>) = 0 [pid 704] <... futex resumed>) = 1 [pid 702] mkdir("./file1", 0777 [pid 701] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 697] <... futex resumed>) = 0 [pid 695] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 706] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 704] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [ 28.531794][ T686] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/16/file1 supports timestamps until 2038 (0x7fffffff) [pid 703] ioctl(5, LOOP_SET_FD, 3 [pid 702] <... mkdir resumed>) = 0 [pid 697] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 695] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 706] <... futex resumed>) = 1 [pid 704] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 703] <... ioctl resumed>) = 0 [pid 697] <... futex resumed>) = 0 [pid 695] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 706] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 704] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 702] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 697] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 3 [ 28.568837][ T703] loop5: detected capacity change from 0 to 512 [ 28.575530][ T698] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 28.575530][ T698] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.575530][ T698] [ 28.595822][ T702] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 28.595822][ T702] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.595822][ T702] [pid 706] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 704] <... open resumed>) = 3 [pid 701] <... write resumed>) = 262144 [pid 693] <... futex resumed>) = 0 [pid 296] fstat(3, [pid 706] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 704] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 701] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 706] <... open resumed>) = 6 [pid 704] <... futex resumed>) = 1 [pid 701] <... futex resumed>) = 1 [pid 697] <... futex resumed>) = 0 [pid 695] <... futex resumed>) = 0 [pid 296] getdents64(3, [pid 706] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 704] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 701] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 697] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 706] <... futex resumed>) = 1 [pid 704] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 697] <... futex resumed>) = 0 [pid 693] <... futex resumed>) = 0 [pid 296] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 706] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 704] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 697] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = 0 [pid 706] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 693] <... futex resumed>) = 0 [pid 296] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 706] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 693] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 706] <... write resumed>) = 262144 [pid 296] lstat("./13/bus", [pid 706] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 706] <... futex resumed>) = 1 [pid 693] <... futex resumed>) = 0 [pid 296] unlink("./13/bus" [pid 706] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... unlink resumed>) = 0 [pid 296] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./13/binderfs") = 0 [ 28.613937][ T700] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [pid 296] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 703] close(3 [pid 686] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 703] <... close resumed>) = 0 [pid 686] chdir("./file1") = 0 [pid 686] ioctl(6, LOOP_CLR_FD) = 0 [pid 686] close(6 [pid 704] <... write resumed>) = 262144 [pid 703] mkdir("./file1", 0777 [pid 702] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 700] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 686] <... close resumed>) = 0 [pid 704] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 703] <... mkdir resumed>) = 0 [pid 702] ioctl(5, LOOP_CLR_FD [pid 700] ioctl(5, LOOP_CLR_FD [pid 704] <... futex resumed>) = 1 [pid 703] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 702] <... ioctl resumed>) = 0 [pid 697] <... futex resumed>) = 0 [pid 686] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] exit_group(0 [pid 704] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 700] <... ioctl resumed>) = 0 [pid 687] <... futex resumed>) = ? [pid 684] <... exit_group resumed>) = ? [pid 687] +++ exited with 0 +++ [pid 703] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 702] close(5 [pid 700] close(5 [pid 686] <... futex resumed>) = ? [pid 703] ioctl(5, LOOP_CLR_FD [pid 702] <... close resumed>) = 0 [pid 700] <... close resumed>) = 0 [pid 703] <... ioctl resumed>) = 0 [pid 702] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 686] +++ exited with 0 +++ [pid 684] +++ exited with 0 +++ [pid 703] close(5 [pid 702] <... futex resumed>) = 0 [pid 700] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 703] <... close resumed>) = 0 [pid 702] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 703] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 700] <... futex resumed>) = 0 [pid 703] <... futex resumed>) = 0 [pid 703] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 700] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 697] exit_group(0 [pid 695] exit_group(0 [pid 693] exit_group(0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=684, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 296] <... umount2 resumed>) = 0 [pid 296] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./13/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 296] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./13/file1") = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./13") = 0 [pid 296] mkdir("./14", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 710 [pid 704] <... futex resumed>) = ? [pid 702] <... futex resumed>) = ? [pid 697] <... exit_group resumed>) = ? [pid 704] +++ exited with 0 +++ [pid 702] +++ exited with 0 +++ [pid 697] +++ exited with 0 +++ [pid 700] <... futex resumed>) = ? [pid 695] <... exit_group resumed>) = ? [pid 700] +++ exited with 0 +++ [pid 703] <... futex resumed>) = ? [pid 693] <... exit_group resumed>) = ? [pid 703] +++ exited with 0 +++ ./strace-static-x86_64: Process 710 attached [pid 710] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 710] chdir("./14") = 0 [pid 710] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 710] setpgid(0, 0) = 0 [pid 710] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 710] write(3, "1000", 4) = 4 [pid 710] close(3) = 0 [pid 710] symlink("/dev/binderfs", "./binderfs") = 0 [pid 710] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 710] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 710] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 710] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[711], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 711 [pid 710] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 710] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 701] <... futex resumed>) = ? [pid 706] <... futex resumed>) = ? [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=697, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 710] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 710] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 710] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[712], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 712 [pid 706] +++ exited with 0 +++ [pid 693] +++ exited with 0 +++ [pid 710] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 701] +++ exited with 0 +++ [pid 695] +++ exited with 0 +++ [pid 299] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=693, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=695, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 299] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... openat resumed>) = 3 [pid 298] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] fstat(3, [pid 298] <... openat resumed>) = 3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] fstat(3, [pid 297] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] getdents64(3, [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... openat resumed>) = 3 [pid 710] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 711 attached [pid 711] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 711] memfd_create("syzkaller", 0) = 3 [pid 711] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] getdents64(3, [pid 300] <... openat resumed>) = 3 [pid 297] fstat(3, [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] fstat(3, [pid 299] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(3, [pid 299] <... umount2 resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] getdents64(3, [pid 711] <... mmap resumed>) = 0x7f35d66dd000 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = 0 [pid 300] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 300] <... umount2 resumed>) = 0 [pid 299] lstat("./17/bus", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] lstat("./16/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] unlink("./17/bus" [pid 297] lstat("./16/bus", [pid 300] lstat("./14/bus", [pid 298] unlink("./16/bus" [pid 299] <... unlink resumed>) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] <... unlink resumed>) = 0 [pid 300] unlink("./14/bus" [pid 299] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] unlink("./16/bus" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... unlink resumed>) = 0 [pid 298] lstat("./16/binderfs", [pid 299] lstat("./17/binderfs", [pid 300] <... unlink resumed>) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] unlink("./17/binderfs" [pid 298] unlink("./16/binderfs" [pid 297] lstat("./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] <... unlink resumed>) = 0 [pid 297] unlink("./16/binderfs" [pid 299] <... unlink resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 300] lstat("./14/binderfs", [pid 299] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] lstat("./17/file1", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./16/file1", [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] unlink("./14/binderfs" [pid 299] openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 711] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... openat resumed>) = 4 [pid 300] <... unlink resumed>) = 0 [pid 299] fstat(4, [pid 297] openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 300] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] fstat(4, [pid 299] getdents64(4, [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] lstat("./14/file1", [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(4, [pid 297] getdents64(4, [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] close(4 [pid 297] close(4 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... close resumed>) = 0 [pid 300] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] rmdir("./17/file1" [pid 297] <... close resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 297] rmdir("./16/file1" [pid 300] <... openat resumed>) = 4 [pid 297] <... rmdir resumed>) = 0 [pid 300] fstat(4, [pid 299] getdents64(3, [pid 711] <... write resumed>) = 262144 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, [pid 300] getdents64(4, [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 711] munmap(0x7f35d66dd000, 262144 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] close(3 [pid 299] close(3 [pid 300] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] <... close resumed>) = 0 [pid 300] close(4 [pid 299] <... close resumed>) = 0 [ 28.645025][ T702] EXT4-fs (loop4): Magic mismatch, very weird! [ 28.656517][ T703] EXT4-fs (loop5): VFS: Can't find ext4 filesystem [ 28.661216][ T698] EXT4-fs (loop0): 1 orphan inode deleted [ 28.668689][ T698] EXT4-fs (loop0): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [pid 297] rmdir("./16" [pid 300] <... close resumed>) = 0 [pid 299] rmdir("./17" [pid 297] <... rmdir resumed>) = 0 [pid 300] rmdir("./14/file1" [pid 711] <... munmap resumed>) = 0 [pid 711] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 299] <... rmdir resumed>) = 0 [pid 711] <... openat resumed>) = 4 [pid 711] ioctl(4, LOOP_SET_FD, 3 [pid 300] <... rmdir resumed>) = 0 [pid 300] getdents64(3, [pid 299] mkdir("./18", 0777 [pid 297] mkdir("./17", 0777 [pid 711] <... ioctl resumed>) = 0 [pid 711] close(3) = 0 [pid 711] mkdir("./file1", 0777 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 711] <... mkdir resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 711] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 297] <... mkdir resumed>) = 0 [pid 300] close(3) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 698] <... mount resumed>) = 0 [pid 300] rmdir("./14" [pid 698] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 698] chdir("./file1") = 0 [pid 698] ioctl(6, LOOP_CLR_FD) = 0 [pid 698] close(6) = 0 [pid 698] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 698] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] <... rmdir resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 300] mkdir("./15", 0777 [pid 691] exit_group(0 [pid 300] <... mkdir resumed>) = 0 [pid 699] <... futex resumed>) = ? [pid 691] <... exit_group resumed>) = ? [pid 699] +++ exited with 0 +++ [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR./strace-static-x86_64: Process 712 attached [pid 712] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 712] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 712] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 710] <... futex resumed>) = 0 [pid 710] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 710] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 712] <... futex resumed>) = 1 [pid 712] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 712] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 710] <... futex resumed>) = 0 [pid 710] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 710] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 712] <... futex resumed>) = 1 [pid 712] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 712] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 710] <... futex resumed>) = 0 [pid 710] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 710] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 712] <... futex resumed>) = 1 [pid 712] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 698] <... futex resumed>) = ? [pid 698] +++ exited with 0 +++ [pid 691] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=691, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 295] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./15/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] unlink("./15/bus") = 0 [pid 295] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./15/binderfs") = 0 [pid 295] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... openat resumed>) = 3 [ 28.712995][ T711] loop1: detected capacity change from 0 to 512 [ 28.720636][ T698] ext4 filesystem being mounted at /root/syzkaller.d28Auw/15/file1 supports timestamps until 2038 (0x7fffffff) [ 28.736499][ T711] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 28.736499][ T711] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.736499][ T711] [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 712] <... write resumed>) = 262144 [pid 712] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 712] <... futex resumed>) = 1 [pid 710] <... futex resumed>) = 0 [pid 712] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... ioctl resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 713 [pid 300] <... openat resumed>) = 3 [pid 300] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 300] close(3) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 714 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 715 ./strace-static-x86_64: Process 714 attached ./strace-static-x86_64: Process 715 attached [pid 715] set_robust_list(0x555556c9c5e0, 24 [pid 714] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 715] <... set_robust_list resumed>) = 0 [pid 714] chdir("./15" [pid 715] chdir("./17" [pid 714] <... chdir resumed>) = 0 [pid 715] <... chdir resumed>) = 0 [pid 714] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 715] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 714] <... prctl resumed>) = 0 [pid 715] <... prctl resumed>) = 0 [pid 715] setpgid(0, 0 [pid 714] setpgid(0, 0) = 0 [pid 715] <... setpgid resumed>) = 0 [pid 714] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 715] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 714] <... openat resumed>) = 3 [pid 714] write(3, "1000", 4 [pid 715] write(3, "1000", 4 [pid 714] <... write resumed>) = 4 [pid 715] <... write resumed>) = 4 [pid 715] close(3 [pid 714] close(3 [pid 715] <... close resumed>) = 0 [pid 714] <... close resumed>) = 0 [pid 714] symlink("/dev/binderfs", "./binderfs" [pid 715] symlink("/dev/binderfs", "./binderfs" [pid 714] <... symlink resumed>) = 0 [pid 715] <... symlink resumed>) = 0 [pid 715] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 715] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 714] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 715] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 714] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 715] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 714] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 714] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[717], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 717 [pid 714] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 715] <... clone resumed>, parent_tid=[716], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 716 [pid 714] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 715] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 714] <... futex resumed>) = 0 [pid 715] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 298] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./16/file1", [pid 714] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 715] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 714] <... mmap resumed>) = 0x7f35deadd000 [pid 298] openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 715] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 715] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] fstat(4, [pid 714] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(4, [pid 715] <... mmap resumed>) = 0x7f35deadd000 [pid 714] <... mprotect resumed>) = 0 [pid 715] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 714] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] close(4) = 0 [pid 298] rmdir("./16/file1" [pid 715] <... mprotect resumed>) = 0 [pid 715] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 713 attached [pid 298] <... rmdir resumed>) = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3 [pid 713] set_robust_list(0x555556c9c5e0, 24 [pid 298] <... close resumed>) = 0 [pid 298] rmdir("./16" [pid 713] <... set_robust_list resumed>) = 0 [pid 713] chdir("./18" [pid 298] <... rmdir resumed>) = 0 [pid 298] mkdir("./17", 0777 [pid 714] <... clone resumed>, parent_tid=[718], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 718 [pid 715] <... clone resumed>, parent_tid=[719], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 719 [pid 714] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 715] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 714] <... futex resumed>) = 0 [pid 715] <... futex resumed>) = 0 [pid 714] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 715] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 713] <... chdir resumed>) = 0 ./strace-static-x86_64: Process 718 attached ./strace-static-x86_64: Process 716 attached [pid 298] <... close resumed>) = 0 [pid 713] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 713] <... prctl resumed>) = 0 [pid 713] setpgid(0, 0) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 720 [pid 713] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 713] write(3, "1000", 4) = 4 [pid 713] close(3) = 0 [pid 713] symlink("/dev/binderfs", "./binderfs") = 0 [pid 713] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 713] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 713] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 713] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[721], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 721 [pid 713] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 713] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 713] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 713] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 713] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[722], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 722 [pid 713] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 713] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 718] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 718] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 716] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 716] memfd_create("syzkaller", 0 [pid 718] <... open resumed>) = 3 [pid 718] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 714] <... futex resumed>) = 0 [pid 714] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 714] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 718] <... futex resumed>) = 1 [pid 718] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 716] <... memfd_create resumed>) = 3 [pid 718] <... mount resumed>) = 0 [pid 716] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 718] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 714] <... futex resumed>) = 0 [pid 714] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 714] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 718] <... futex resumed>) = 1 [pid 718] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 718] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 714] <... futex resumed>) = 0 [pid 714] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 714] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 718] <... futex resumed>) = 1 [pid 718] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 718] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 714] <... futex resumed>) = 0 [pid 718] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 711] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 711] ioctl(4, LOOP_CLR_FD./strace-static-x86_64: Process 720 attached ./strace-static-x86_64: Process 719 attached ) = 0 [pid 711] close(4) = 0 [pid 711] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 711] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 716] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 710] exit_group(0 [pid 712] <... futex resumed>) = ? [pid 711] <... futex resumed>) = ? [pid 710] <... exit_group resumed>) = ? [pid 712] +++ exited with 0 +++ [pid 716] <... write resumed>) = 262144 ./strace-static-x86_64: Process 722 attached [pid 722] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 722] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 719] set_robust_list(0x7f35deafd9e0, 24 [pid 716] munmap(0x7f35d66dd000, 262144 [pid 720] set_robust_list(0x555556c9c5e0, 24 [pid 719] <... set_robust_list resumed>) = 0 [pid 716] <... munmap resumed>) = 0 [pid 722] <... open resumed>) = 3 ./strace-static-x86_64: Process 721 attached [pid 721] set_robust_list(0x7f35deb1e9e0, 24 [pid 722] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] <... futex resumed>) = 0 [pid 713] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 713] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 722] <... futex resumed>) = 1 [pid 721] <... set_robust_list resumed>) = 0 [pid 722] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 721] memfd_create("syzkaller", 0 [pid 716] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 722] <... mount resumed>) = 0 [pid 721] <... memfd_create resumed>) = 4 [pid 716] <... openat resumed>) = 4 [pid 719] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 722] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 721] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 720] <... set_robust_list resumed>) = 0 [pid 716] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 717 attached [pid 722] <... futex resumed>) = 1 [pid 721] <... mmap resumed>) = 0x7f35d66dd000 [pid 720] chdir("./17" [pid 719] <... open resumed>) = 5 [pid 713] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 722] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 721] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 720] <... chdir resumed>) = 0 [pid 719] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 717] set_robust_list(0x7f35deb1e9e0, 24 [pid 716] <... ioctl resumed>) = 0 [pid 713] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 722] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 720] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 719] <... futex resumed>) = 1 [pid 717] <... set_robust_list resumed>) = 0 [pid 716] close(3 [pid 715] <... futex resumed>) = 0 [pid 713] <... futex resumed>) = 0 [pid 295] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 722] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 721] <... write resumed>) = 262144 [pid 720] <... prctl resumed>) = 0 [pid 719] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 715] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 722] <... open resumed>) = 5 [pid 721] munmap(0x7f35d66dd000, 262144 [pid 717] memfd_create("syzkaller", 0 [pid 715] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 722] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 721] <... munmap resumed>) = 0 [pid 720] setpgid(0, 0 [pid 719] <... mount resumed>) = 0 [pid 715] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 717] <... memfd_create resumed>) = 5 [pid 722] <... futex resumed>) = 1 [pid 721] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 713] <... futex resumed>) = 0 [pid 295] lstat("./15/file1", [pid 722] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 721] <... openat resumed>) = 6 [pid 720] <... setpgid resumed>) = 0 [pid 719] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 717] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 716] <... close resumed>) = 0 [pid 713] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 720] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 719] <... futex resumed>) = 1 [pid 717] <... mmap resumed>) = 0x7f35d66dd000 [pid 716] mkdir("./file1", 0777 [pid 295] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 720] <... openat resumed>) = 3 [pid 719] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 717] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 716] <... mkdir resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 720] write(3, "1000", 4 [pid 717] <... write resumed>) = 262144 [ 28.763327][ T711] EXT4-fs (loop1): Magic mismatch, very weird! [ 28.795828][ T716] loop2: detected capacity change from 0 to 512 [pid 716] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 295] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 722] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 721] ioctl(6, LOOP_SET_FD, 4 [pid 720] <... write resumed>) = 4 [pid 717] munmap(0x7f35d66dd000, 262144 [pid 715] <... futex resumed>) = 0 [pid 713] <... futex resumed>) = 0 [pid 711] +++ exited with 0 +++ [pid 710] +++ exited with 0 +++ [pid 722] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 720] close(3 [pid 717] <... munmap resumed>) = 0 [pid 715] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=710, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] <... openat resumed>) = 4 [pid 719] <... futex resumed>) = 0 [pid 715] <... futex resumed>) = 1 [pid 719] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 715] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 719] <... open resumed>) = 3 [pid 719] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 715] <... futex resumed>) = 0 [pid 719] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 715] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 720] <... close resumed>) = 0 [pid 719] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 717] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 715] <... futex resumed>) = 0 [pid 720] symlink("/dev/binderfs", "./binderfs" [pid 719] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 715] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] fstat(4, [pid 721] <... ioctl resumed>) = 0 [pid 720] <... symlink resumed>) = 0 [pid 719] <... write resumed>) = 262144 [pid 717] <... openat resumed>) = 6 [pid 719] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 715] <... futex resumed>) = 0 [pid 719] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./15/file1") = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./15") = 0 [pid 295] mkdir("./16", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 723 ./strace-static-x86_64: Process 723 attached [pid 723] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 723] chdir("./16") = 0 [pid 723] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 721] close(4 [pid 720] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 717] ioctl(6, LOOP_SET_FD, 5 [pid 723] setpgid(0, 0) = 0 [pid 723] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 723] write(3, "1000", 4) = 4 [pid 723] close(3) = 0 [pid 723] symlink("/dev/binderfs", "./binderfs" [pid 721] <... close resumed>) = 0 [pid 720] <... futex resumed>) = 0 [pid 723] <... symlink resumed>) = 0 [pid 723] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 723] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [ 28.814099][ T716] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 28.814099][ T716] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.814099][ T716] [ 28.817417][ T721] loop4: detected capacity change from 0 to 512 [ 28.841692][ T722] blk_update_request: I/O error, dev loop4, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 28.855056][ T722] Buffer I/O error on dev loop4, logical block 0, lost async page write [pid 723] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 723] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[724], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 724 [pid 723] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 723] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 723] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 723] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 723] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[725], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 725 [pid 723] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 723] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 724 attached [pid 724] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 724] memfd_create("syzkaller", 0) = 3 [pid 724] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 717] <... ioctl resumed>) = 0 [pid 720] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 721] mkdir("./file1", 0777 [pid 720] <... mmap resumed>) = 0x7f35deafe000 [pid 724] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 721] <... mkdir resumed>) = 0 [pid 720] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 721] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 296] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 720] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 720] <... clone resumed>, parent_tid=[727], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 727 [pid 296] <... openat resumed>) = 3 [pid 720] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] fstat(3, [pid 720] <... futex resumed>) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 ./strace-static-x86_64: Process 727 attached ./strace-static-x86_64: Process 725 attached [pid 720] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 717] close(5 [pid 296] getdents64(3, [pid 727] set_robust_list(0x7f35deb1e9e0, 24 [pid 725] set_robust_list(0x7f35deafd9e0, 24 [pid 720] <... futex resumed>) = 0 [pid 717] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 720] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 727] <... set_robust_list resumed>) = 0 [pid 725] <... set_robust_list resumed>) = 0 [pid 717] mkdir("./file1", 0777 [pid 296] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 720] <... mmap resumed>) = 0x7f35deadd000 [pid 727] memfd_create("syzkaller", 0 [pid 717] <... mkdir resumed>) = 0 [pid 720] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 727] <... memfd_create resumed>) = 3 [pid 725] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 720] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 717] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 296] <... umount2 resumed>) = 0 [pid 727] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 296] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 727] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 720] <... clone resumed>, parent_tid=[729], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 729 [pid 296] lstat("./14/bus", [pid 722] <... write resumed>) = -1 EIO (Input/output error) [pid 722] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] <... futex resumed>) = 0 [pid 722] <... futex resumed>) = 1 [pid 722] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 729 attached [pid 729] set_robust_list(0x7f35deafd9e0, 24) = 0 [ 28.866323][ T717] loop5: detected capacity change from 0 to 512 [ 28.881701][ T716] EXT4-fs (loop2): 1 orphan inode deleted [ 28.887300][ T717] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 28.887300][ T717] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.887300][ T717] [pid 729] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 727] <... write resumed>) = 262144 [pid 725] <... open resumed>) = 4 [pid 723] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 720] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 729] <... futex resumed>) = 0 [pid 723] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 720] <... futex resumed>) = 1 [pid 296] unlink("./14/bus" [pid 729] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 723] <... futex resumed>) = 0 [pid 720] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... unlink resumed>) = 0 [pid 729] <... open resumed>) = 4 [pid 723] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 729] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 723] <... mmap resumed>) = 0x7f35d66bc000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 729] <... futex resumed>) = 1 [pid 723] mprotect(0x7f35d66bd000, 131072, PROT_READ|PROT_WRITE [pid 720] <... futex resumed>) = 0 [pid 296] lstat("./14/binderfs", [pid 729] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 723] <... mprotect resumed>) = 0 [pid 720] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 729] <... mount resumed>) = 0 [pid 723] clone(child_stack=0x7f35d66dc3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 720] <... futex resumed>) = 0 [pid 296] unlink("./14/binderfs" [pid 729] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 720] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... unlink resumed>) = 0 [pid 729] <... futex resumed>) = 0 [pid 723] <... clone resumed>, parent_tid=[730], tls=0x7f35d66dc700, child_tidptr=0x7f35d66dc9d0) = 730 [pid 720] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 729] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 723] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 720] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 729] <... open resumed>) = 5 [pid 723] <... futex resumed>) = 0 [pid 720] <... futex resumed>) = 0 [pid 296] lstat("./14/file1", [pid 729] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 723] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 720] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 729] <... futex resumed>) = 0 [pid 720] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] umount2("./14/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 729] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 720] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 729] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 720] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 729] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 727] munmap(0x7f35d66dd000, 262144 [pid 720] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... openat resumed>) = 4 [pid 720] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 729] <... futex resumed>) = 0 [pid 727] <... munmap resumed>) = 0 [pid 296] fstat(4, [pid 729] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./14/file1") = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./14") = 0 [pid 296] mkdir("./15", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3 [pid 727] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 725] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 724] <... write resumed>) = 262144 [pid 716] <... mount resumed>) = 0 [pid 296] <... close resumed>) = 0 [ 28.889621][ T716] EXT4-fs (loop2): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 28.907071][ T721] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 28.907071][ T721] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.907071][ T721] [ 28.928148][ T716] ext4 filesystem being mounted at /root/syzkaller.7ngmbG/17/file1 supports timestamps until 2038 (0x7fffffff) [pid 727] <... openat resumed>) = 6 [pid 725] <... futex resumed>) = 0 [pid 724] munmap(0x7f35d66dd000, 262144 [pid 716] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 727] ioctl(6, LOOP_SET_FD, 3 [pid 725] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 724] <... munmap resumed>) = 0 [pid 716] <... openat resumed>) = 6 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 731 [pid 724] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 716] chdir("./file1" [pid 724] <... openat resumed>) = 5 [pid 716] <... chdir resumed>) = 0 [pid 724] ioctl(5, LOOP_SET_FD, 3 [pid 716] ioctl(4, LOOP_CLR_FD./strace-static-x86_64: Process 731 attached ./strace-static-x86_64: Process 730 attached [pid 727] <... ioctl resumed>) = 0 [pid 721] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 731] set_robust_list(0x555556c9c5e0, 24 [pid 730] set_robust_list(0x7f35d66dc9e0, 24 [pid 721] ioctl(6, LOOP_CLR_FD [pid 731] <... set_robust_list resumed>) = 0 [pid 730] <... set_robust_list resumed>) = 0 [pid 721] <... ioctl resumed>) = 0 [pid 731] chdir("./15" [pid 730] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 721] close(6 [pid 731] <... chdir resumed>) = 0 [pid 730] <... mount resumed>) = 0 [pid 721] <... close resumed>) = 0 [pid 731] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 730] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 727] close(3 [pid 721] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 731] <... prctl resumed>) = 0 [pid 730] <... futex resumed>) = 1 [pid 727] <... close resumed>) = 0 [pid 721] <... futex resumed>) = 0 [pid 731] setpgid(0, 0 [pid 730] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 727] mkdir("./file1", 0777 [pid 721] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 731] <... setpgid resumed>) = 0 [pid 727] <... mkdir resumed>) = 0 [pid 731] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 727] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 731] write(3, "1000", 4) = 4 [pid 731] close(3) = 0 [pid 731] symlink("/dev/binderfs", "./binderfs") = 0 [pid 731] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 731] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 731] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 731] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[733], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 733 [pid 731] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 731] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 731] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 731] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 731] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[734], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 734 [pid 731] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 731] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 713] exit_group(0 [pid 722] <... futex resumed>) = ? [pid 721] <... futex resumed>) = ? [pid 713] <... exit_group resumed>) = ? [pid 722] +++ exited with 0 +++ [pid 721] +++ exited with 0 +++ [pid 716] <... ioctl resumed>) = 0 [pid 716] close(4) = 0 [pid 716] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 28.959161][ T721] EXT4-fs (loop4): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 28.959997][ T727] loop3: detected capacity change from 0 to 512 [ 28.968776][ T721] EXT4-fs (loop4): group descriptors corrupted! [ 28.978710][ T724] loop0: detected capacity change from 0 to 512 [ 28.987326][ T727] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 28.987326][ T727] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.987326][ T727] [ 28.990249][ T724] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [pid 716] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 734 attached ./strace-static-x86_64: Process 733 attached [pid 724] <... ioctl resumed>) = 0 [pid 723] <... futex resumed>) = 0 [pid 715] exit_group(0 [pid 734] set_robust_list(0x7f35deafd9e0, 24 [pid 733] set_robust_list(0x7f35deb1e9e0, 24 [pid 724] close(3 [pid 723] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 734] <... set_robust_list resumed>) = 0 [pid 733] <... set_robust_list resumed>) = 0 [pid 725] <... futex resumed>) = 0 [pid 724] <... close resumed>) = 0 [pid 723] <... futex resumed>) = 1 [pid 734] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 733] memfd_create("syzkaller", 0 [pid 725] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 724] mkdir("./file1", 0777 [pid 723] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 734] <... open resumed>) = 4 [pid 733] <... memfd_create resumed>) = 3 [pid 725] <... open resumed>) = 3 [pid 724] <... mkdir resumed>) = 0 [pid 734] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 733] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 725] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 724] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 734] <... futex resumed>) = 1 [pid 733] <... mmap resumed>) = 0x7f35d66dd000 [pid 731] <... futex resumed>) = 0 [pid 725] <... futex resumed>) = 1 [pid 723] <... futex resumed>) = 0 [pid 731] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 725] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 723] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 725] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 723] <... futex resumed>) = 0 [pid 725] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 723] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 719] <... futex resumed>) = ? [pid 716] <... futex resumed>) = ? [pid 715] <... exit_group resumed>) = ? [pid 731] <... futex resumed>) = 0 [pid 716] +++ exited with 0 +++ [pid 719] +++ exited with 0 +++ [pid 734] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 734] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 734] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 713] +++ exited with 0 +++ [pid 733] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 733] munmap(0x7f35d66dd000, 262144) = 0 [pid 733] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 5 [pid 733] ioctl(5, LOOP_SET_FD, 3 [pid 731] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 715] +++ exited with 0 +++ [pid 733] <... ioctl resumed>) = 0 [pid 733] close(3) = 0 [pid 733] mkdir("./file1", 0777) = 0 [pid 733] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 731] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 725] <... write resumed>) = 262144 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=713, si_uid=0, si_status=0, si_utime=0, si_stime=11} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=715, si_uid=0, si_status=0, si_utime=0, si_stime=9} --- [pid 724] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 724] ioctl(5, LOOP_CLR_FD) = 0 [pid 724] close(5) = 0 [pid 724] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 28.990249][ T724] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 28.990249][ T724] [ 29.031300][ T733] loop1: detected capacity change from 0 to 512 [ 29.036151][ T717] EXT4-fs (loop5): 1 orphan inode deleted [ 29.039253][ T724] EXT4-fs (loop0): Magic mismatch, very weird! [ 29.043407][ T733] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 29.043407][ T733] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.043407][ T733] [pid 724] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 731] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 725] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 734] <... futex resumed>) = 0 [pid 731] <... futex resumed>) = 1 [pid 725] <... futex resumed>) = 0 [pid 723] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 717] <... mount resumed>) = 0 [pid 717] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 717] chdir("./file1") = 0 [pid 717] ioctl(6, LOOP_CLR_FD) = 0 [pid 717] close(6) = 0 [pid 717] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 29.058246][ T717] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 29.073388][ T727] EXT4-fs (loop3): 1 orphan inode deleted [ 29.090489][ T717] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/15/file1 supports timestamps until 2038 (0x7fffffff) [pid 717] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 734] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 731] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 725] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 723] exit_group(0 [pid 299] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 734] <... open resumed>) = 3 [pid 730] <... futex resumed>) = ? [pid 725] <... futex resumed>) = ? [pid 724] <... futex resumed>) = ? [pid 723] <... exit_group resumed>) = ? [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 734] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 730] +++ exited with 0 +++ [pid 725] +++ exited with 0 +++ [pid 724] +++ exited with 0 +++ [pid 299] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 734] <... futex resumed>) = 1 [pid 731] <... futex resumed>) = 0 [pid 714] exit_group(0 [pid 299] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 734] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 731] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 718] <... futex resumed>) = ? [pid 717] <... futex resumed>) = ? [pid 714] <... exit_group resumed>) = ? [pid 299] fstat(3, [pid 297] fstat(3, [pid 731] <... futex resumed>) = 0 [pid 718] +++ exited with 0 +++ [pid 717] +++ exited with 0 +++ [pid 714] +++ exited with 0 +++ [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 731] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 727] <... mount resumed>) = 0 [pid 299] getdents64(3, [pid 297] getdents64(3, [pid 727] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=714, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 299] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... restart_syscall resumed>) = 0 [pid 300] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 300] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(3, [pid 734] <... write resumed>) = 262144 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 734] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 734] <... futex resumed>) = 1 [pid 731] <... futex resumed>) = 0 [pid 734] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 727] chdir("./file1") = 0 [pid 727] ioctl(6, LOOP_CLR_FD) = 0 [pid 727] close(6) = 0 [pid 727] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 727] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 720] exit_group(0 [pid 729] <... futex resumed>) = ? [pid 727] <... futex resumed>) = ? [pid 720] <... exit_group resumed>) = ? [pid 733] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 729] +++ exited with 0 +++ [pid 727] +++ exited with 0 +++ [pid 720] +++ exited with 0 +++ [pid 733] ioctl(5, LOOP_CLR_FD) = 0 [pid 733] close(5 [pid 297] <... umount2 resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=720, si_uid=0, si_status=0, si_utime=0, si_stime=9} --- [pid 297] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 733] <... close resumed>) = 0 [pid 300] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] lstat("./17/bus", [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] lstat("./15/bus", [pid 299] lstat("./18/bus", [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] unlink("./18/bus" [pid 297] unlink("./17/bus" [pid 298] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 733] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 733] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... unlink resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 300] unlink("./15/bus" [pid 299] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] fstat(3, [pid 297] <... unlink resumed>) = 0 [pid 731] exit_group(0 [pid 300] <... unlink resumed>) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 734] <... futex resumed>) = ? [pid 731] <... exit_group resumed>) = ? [pid 300] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] getdents64(3, [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 733] <... futex resumed>) = ? [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] lstat("./18/binderfs", [pid 297] lstat("./17/binderfs", [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 734] +++ exited with 0 +++ [pid 300] lstat("./15/binderfs", [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./18/binderfs" [pid 298] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] unlink("./17/binderfs" [pid 300] unlink("./15/binderfs" [pid 299] <... unlink resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] lstat("./17/bus", [pid 297] <... unlink resumed>) = 0 [pid 300] <... unlink resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] lstat("./18/file1", [pid 298] unlink("./17/bus" [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... unlink resumed>) = 0 [pid 299] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] lstat("./17/binderfs", [pid 299] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] unlink("./17/binderfs" [pid 299] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] <... unlink resumed>) = 0 [pid 299] close(4) = 0 [pid 298] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] rmdir("./18/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./18") = 0 [pid 299] mkdir("./19", 0777) = 0 [pid 723] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=723, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 295] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./16/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] unlink("./16/bus") = 0 [pid 295] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 295] unlink("./16/binderfs") = 0 [pid 295] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./16/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./16/file1" [pid 299] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] <... rmdir resumed>) = 0 [pid 299] close(3) = 0 [pid 295] getdents64(3, [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 738 [pid 295] close(3./strace-static-x86_64: Process 738 attached ) = 0 [pid 738] set_robust_list(0x555556c9c5e0, 24 [pid 295] rmdir("./16" [pid 738] <... set_robust_list resumed>) = 0 [pid 738] chdir("./19") = 0 [pid 295] <... rmdir resumed>) = 0 [pid 738] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 295] mkdir("./17", 0777 [pid 738] <... prctl resumed>) = 0 [pid 738] setpgid(0, 0) = 0 [pid 738] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] <... mkdir resumed>) = 0 [pid 738] <... openat resumed>) = 3 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 738] write(3, "1000", 4) = 4 [pid 295] <... openat resumed>) = 3 [pid 738] close(3 [pid 295] ioctl(3, LOOP_CLR_FD [pid 738] <... close resumed>) = 0 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 738] symlink("/dev/binderfs", "./binderfs" [pid 295] close(3 [pid 738] <... symlink resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 738] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 738] <... futex resumed>) = 0 [pid 738] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 738] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 738] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 739 [pid 738] <... clone resumed>, parent_tid=[740], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 740 [pid 738] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 738] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 738] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 738] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 738] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 740 attached ./strace-static-x86_64: Process 741 attached [pid 740] set_robust_list(0x7f35deb1e9e0, 24 [pid 738] <... clone resumed>, parent_tid=[741], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 741 [pid 738] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 740] <... set_robust_list resumed>) = 0 [pid 738] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 741] set_robust_list(0x7f35deafd9e0, 24 [pid 740] memfd_create("syzkaller", 0./strace-static-x86_64: Process 739 attached [pid 739] set_robust_list(0x555556c9c5e0, 24 [pid 740] <... memfd_create resumed>) = 3 [pid 741] <... set_robust_list resumed>) = 0 [pid 739] <... set_robust_list resumed>) = 0 [pid 741] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 740] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 739] chdir("./17") = 0 [pid 739] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 739] setpgid(0, 0 [pid 740] <... mmap resumed>) = 0x7f35d66dd000 [pid 739] <... setpgid resumed>) = 0 [pid 739] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 739] write(3, "1000", 4) = 4 [pid 739] close(3) = 0 [pid 739] symlink("/dev/binderfs", "./binderfs") = 0 [pid 739] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 739] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 739] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 739] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[742], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 742 [pid 739] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 739] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 739] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 739] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 739] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 740] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 739] <... clone resumed>, parent_tid=[743], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 743 [pid 739] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 739] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 743 attached [pid 743] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 743] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 743] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 739] <... futex resumed>) = 0 [pid 739] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 743] <... futex resumed>) = 1 [pid 739] <... futex resumed>) = 0 [pid 739] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 743] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 740] <... write resumed>) = 262144 [pid 740] munmap(0x7f35d66dd000, 262144 [pid 743] <... mount resumed>) = 0 [pid 743] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 739] <... futex resumed>) = 0 [pid 739] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 739] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 740] <... munmap resumed>) = 0 [pid 743] <... futex resumed>) = 1 [pid 741] <... open resumed>) = 4 [pid 743] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 743] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 740] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 741] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 739] <... futex resumed>) = 0 [pid 739] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 739] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 743] <... futex resumed>) = 1 [pid 743] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 743] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 739] <... futex resumed>) = 0 [pid 743] <... futex resumed>) = 1 [pid 743] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 742 attached [pid 742] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 742] memfd_create("syzkaller", 0) = 5 [pid 742] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 733] +++ exited with 0 +++ [pid 731] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=731, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 296] umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 296] umount2("./15/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./15/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] unlink("./15/bus") = 0 [pid 296] umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 29.099840][ T727] EXT4-fs (loop3): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 29.130011][ T727] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/17/file1 supports timestamps until 2038 (0x7fffffff) [ 29.142950][ T733] EXT4-fs (loop1): Magic mismatch, very weird! [pid 296] lstat("./15/binderfs", [pid 740] <... openat resumed>) = 5 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./15/binderfs" [pid 740] ioctl(5, LOOP_SET_FD, 3 [pid 296] <... unlink resumed>) = 0 [pid 296] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./15/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 742] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 742] munmap(0x7f35d66dd000, 262144) = 0 [pid 742] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 742] ioctl(6, LOOP_SET_FD, 5 [pid 741] <... futex resumed>) = 1 [pid 740] <... ioctl resumed>) = 0 [pid 300] <... umount2 resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 742] <... ioctl resumed>) = 0 [pid 741] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 740] close(3 [pid 738] <... futex resumed>) = 0 [pid 300] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... openat resumed>) = 4 [pid 300] lstat("./15/file1", [pid 298] lstat("./17/file1", [pid 297] lstat("./17/file1", [pid 296] fstat(4, [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] umount2("./15/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(4, [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] getdents64(4, [pid 300] <... openat resumed>) = 4 [pid 298] <... openat resumed>) = 4 [pid 297] <... openat resumed>) = 4 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] fstat(4, [pid 298] fstat(4, [pid 297] fstat(4, [pid 296] close(4 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... close resumed>) = 0 [pid 300] getdents64(4, [pid 298] getdents64(4, [pid 297] getdents64(4, [pid 296] rmdir("./15/file1" [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] <... rmdir resumed>) = 0 [pid 300] getdents64(4, [pid 298] getdents64(4, [pid 297] getdents64(4, [pid 296] getdents64(3, [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] close(4 [pid 298] close(4 [pid 297] close(4 [pid 296] close(3 [pid 300] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 300] rmdir("./15/file1" [pid 298] rmdir("./17/file1" [pid 297] rmdir("./17/file1" [pid 296] rmdir("./15" [pid 738] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... rmdir resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 300] getdents64(3, [pid 298] getdents64(3, [pid 297] getdents64(3, [pid 296] <... rmdir resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] mkdir("./16", 0777 [pid 300] close(3 [pid 298] close(3 [pid 297] close(3 [pid 296] <... mkdir resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 300] rmdir("./15" [pid 298] rmdir("./17" [pid 297] rmdir("./17" [pid 741] <... futex resumed>) = 0 [pid 738] <... futex resumed>) = 1 [pid 300] <... rmdir resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 741] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 738] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] mkdir("./16", 0777 [pid 298] mkdir("./18", 0777 [pid 297] mkdir("./18", 0777 [pid 296] ioctl(3, LOOP_CLR_FD [pid 741] <... mount resumed>) = 0 [pid 300] <... mkdir resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 741] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 296] close(3 [pid 741] <... futex resumed>) = 1 [pid 738] <... futex resumed>) = 0 [pid 300] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 741] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 738] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] ioctl(3, LOOP_CLR_FD [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 741] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 738] <... futex resumed>) = 0 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 741] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 738] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] close(3 [pid 298] close(3 [pid 297] close(3 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 744 [pid 740] <... close resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 740] mkdir("./file1", 0777 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 741] <... open resumed>) = 3 [pid 740] <... mkdir resumed>) = 0 [pid 741] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 740] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 745 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 746 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 747 ./strace-static-x86_64: Process 746 attached ./strace-static-x86_64: Process 745 attached ./strace-static-x86_64: Process 744 attached [pid 741] <... futex resumed>) = 1 [pid 738] <... futex resumed>) = 0 [pid 741] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 738] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 745] set_robust_list(0x555556c9c5e0, 24 [pid 744] set_robust_list(0x555556c9c5e0, 24 [pid 741] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 738] <... futex resumed>) = 0 [pid 746] set_robust_list(0x555556c9c5e0, 24 [pid 745] <... set_robust_list resumed>) = 0 [pid 746] <... set_robust_list resumed>) = 0 [pid 744] <... set_robust_list resumed>) = 0 [pid 741] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 738] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 745] chdir("./16" [pid 742] close(5) = 0 [pid 742] mkdir("./file1", 0777) = 0 [ 29.183503][ T740] loop4: detected capacity change from 0 to 512 [ 29.186660][ T742] loop0: detected capacity change from 0 to 512 [ 29.214305][ T740] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 29.214305][ T740] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.214305][ T740] [pid 742] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 746] chdir("./18" [pid 745] <... chdir resumed>) = 0 [pid 744] chdir("./16" [pid 741] <... write resumed>) = 262144 [pid 746] <... chdir resumed>) = 0 [pid 745] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 744] <... chdir resumed>) = 0 [pid 741] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 746] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 745] <... prctl resumed>) = 0 [pid 744] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 741] <... futex resumed>) = 1 [pid 738] <... futex resumed>) = 0 [pid 746] <... prctl resumed>) = 0 [pid 745] setpgid(0, 0 [pid 744] <... prctl resumed>) = 0 [pid 741] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 746] setpgid(0, 0 [pid 745] <... setpgid resumed>) = 0 [pid 744] setpgid(0, 0 [pid 746] <... setpgid resumed>) = 0 [pid 745] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 744] <... setpgid resumed>) = 0 [pid 746] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 745] <... openat resumed>) = 3 [pid 744] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 746] <... openat resumed>) = 3 [pid 745] write(3, "1000", 4 [pid 746] write(3, "1000", 4 [pid 745] <... write resumed>) = 4 [pid 744] <... openat resumed>) = 3 [pid 746] <... write resumed>) = 4 [pid 745] close(3 [pid 744] write(3, "1000", 4 [pid 746] close(3 [pid 745] <... close resumed>) = 0 [pid 744] <... write resumed>) = 4 [pid 746] <... close resumed>) = 0 [pid 745] symlink("/dev/binderfs", "./binderfs" [pid 744] close(3 [pid 746] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 747 attached ) = 0 [pid 745] <... symlink resumed>) = 0 [pid 744] <... close resumed>) = 0 [pid 746] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 745] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 744] symlink("/dev/binderfs", "./binderfs" [pid 746] <... futex resumed>) = 0 [pid 745] <... futex resumed>) = 0 [pid 747] set_robust_list(0x555556c9c5e0, 24 [pid 746] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 745] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 744] <... symlink resumed>) = 0 [pid 747] <... set_robust_list resumed>) = 0 [pid 746] <... mmap resumed>) = 0x7f35deafe000 [pid 745] <... mmap resumed>) = 0x7f35deafe000 [pid 744] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 747] chdir("./18" [pid 746] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 745] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 744] <... futex resumed>) = 0 [pid 747] <... chdir resumed>) = 0 [pid 746] <... mprotect resumed>) = 0 [pid 745] <... mprotect resumed>) = 0 [pid 744] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 747] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 746] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 745] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 744] <... mmap resumed>) = 0x7f35deafe000 [pid 747] <... prctl resumed>) = 0 [pid 744] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 747] setpgid(0, 0 [pid 746] <... clone resumed>, parent_tid=[748], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 748 [pid 745] <... clone resumed>, parent_tid=[749], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 749 [pid 744] <... mprotect resumed>) = 0 [pid 746] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 745] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 747] <... setpgid resumed>) = 0 [pid 746] <... futex resumed>) = 0 [pid 745] <... futex resumed>) = 0 [pid 744] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 747] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 746] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 745] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 750 attached ./strace-static-x86_64: Process 749 attached ./strace-static-x86_64: Process 748 attached [pid 747] <... openat resumed>) = 3 [pid 746] <... futex resumed>) = 0 [pid 745] <... futex resumed>) = 0 [pid 744] <... clone resumed>, parent_tid=[750], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 750 [pid 740] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 750] set_robust_list(0x7f35deb1e9e0, 24 [pid 749] set_robust_list(0x7f35deb1e9e0, 24 [pid 748] set_robust_list(0x7f35deb1e9e0, 24 [pid 747] write(3, "1000", 4 [pid 746] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 745] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 744] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 740] ioctl(5, LOOP_CLR_FD [pid 750] <... set_robust_list resumed>) = 0 [pid 749] <... set_robust_list resumed>) = 0 [pid 748] <... set_robust_list resumed>) = 0 [pid 746] <... mmap resumed>) = 0x7f35deadd000 [pid 745] <... mmap resumed>) = 0x7f35deadd000 [pid 744] <... futex resumed>) = 0 [pid 740] <... ioctl resumed>) = 0 [pid 747] <... write resumed>) = 4 [pid 750] memfd_create("syzkaller", 0 [pid 749] memfd_create("syzkaller", 0 [pid 748] memfd_create("syzkaller", 0 [pid 747] close(3 [pid 746] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 745] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 747] <... close resumed>) = 0 [pid 747] symlink("/dev/binderfs", "./binderfs") = 0 [pid 747] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 747] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 747] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 747] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[753], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 753 [pid 747] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 747] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 747] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 747] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [ 29.240081][ T742] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 29.240081][ T742] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.240081][ T742] [ 29.268323][ T740] EXT4-fs (loop4): Magic mismatch, very weird! [ 29.278047][ T742] EXT4-fs (loop0): 1 orphan inode deleted [pid 747] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[754], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 754 [pid 747] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 747] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 744] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 744] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 744] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 744] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[755], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 755 [pid 744] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 744] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 740] close(5) = 0 [pid 740] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 740] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 750] <... memfd_create resumed>) = 3 [pid 750] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 750] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 750] munmap(0x7f35d66dd000, 262144) = 0 [pid 750] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 750] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 754 attached ./strace-static-x86_64: Process 753 attached ) = 0 [pid 749] <... memfd_create resumed>) = 3 [pid 748] <... memfd_create resumed>) = 3 [pid 746] <... mprotect resumed>) = 0 [pid 745] <... mprotect resumed>) = 0 [pid 738] exit_group(0 [pid 749] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 748] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 746] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 745] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 741] <... futex resumed>) = ? [pid 740] <... futex resumed>) = ? [pid 738] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 757 attached ./strace-static-x86_64: Process 756 attached ./strace-static-x86_64: Process 755 attached [pid 754] set_robust_list(0x7f35deafd9e0, 24 [pid 753] set_robust_list(0x7f35deb1e9e0, 24 [pid 750] close(3 [pid 749] <... mmap resumed>) = 0x7f35d66dd000 [pid 748] <... mmap resumed>) = 0x7f35d66dd000 [pid 742] <... mount resumed>) = 0 [pid 741] +++ exited with 0 +++ [pid 740] +++ exited with 0 +++ [pid 757] set_robust_list(0x7f35deafd9e0, 24 [pid 756] set_robust_list(0x7f35deafd9e0, 24 [pid 755] set_robust_list(0x7f35deafd9e0, 24 [pid 754] <... set_robust_list resumed>) = 0 [pid 753] <... set_robust_list resumed>) = 0 [pid 750] <... close resumed>) = 0 [ 29.283583][ T742] EXT4-fs (loop0): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 29.299168][ T750] loop1: detected capacity change from 0 to 512 [ 29.312561][ T742] ext4 filesystem being mounted at /root/syzkaller.d28Auw/17/file1 supports timestamps until 2038 (0x7fffffff) [ 29.329074][ T750] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [pid 742] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 756] <... set_robust_list resumed>) = 0 [pid 755] <... set_robust_list resumed>) = 0 [pid 754] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 753] memfd_create("syzkaller", 0 [pid 750] mkdir("./file1", 0777 [pid 742] <... openat resumed>) = 5 [pid 756] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 755] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 754] <... open resumed>) = 3 [pid 753] <... memfd_create resumed>) = 4 [pid 750] <... mkdir resumed>) = 0 [pid 742] chdir("./file1" [pid 755] <... open resumed>) = 3 [pid 754] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 753] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 750] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 742] <... chdir resumed>) = 0 [pid 755] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 754] <... futex resumed>) = 1 [pid 753] <... mmap resumed>) = 0x7f35d66dd000 [pid 749] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 747] <... futex resumed>) = 0 [pid 742] ioctl(6, LOOP_CLR_FD [pid 755] <... futex resumed>) = 1 [pid 754] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 753] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 748] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 747] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 746] <... clone resumed>, parent_tid=[756], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 756 [pid 745] <... clone resumed>, parent_tid=[757], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 757 [pid 744] <... futex resumed>) = 0 [pid 742] <... ioctl resumed>) = 0 [pid 755] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 754] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 753] <... write resumed>) = 262144 [pid 747] <... futex resumed>) = 0 [pid 744] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 742] close(6 [pid 755] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 754] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 753] munmap(0x7f35d66dd000, 262144 [pid 747] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 744] <... futex resumed>) = 0 [pid 742] <... close resumed>) = 0 [pid 755] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 754] <... mount resumed>) = 0 [pid 753] <... munmap resumed>) = 0 [pid 744] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 742] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 755] <... mount resumed>) = 0 [pid 754] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 753] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 742] <... futex resumed>) = 0 [pid 755] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 754] <... futex resumed>) = 1 [pid 753] <... openat resumed>) = 5 [pid 747] <... futex resumed>) = 0 [pid 742] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 755] <... futex resumed>) = 1 [pid 754] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 753] ioctl(5, LOOP_SET_FD, 4 [pid 747] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 744] <... futex resumed>) = 0 [pid 757] <... set_robust_list resumed>) = 0 [pid 755] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 754] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 749] <... write resumed>) = 262144 [pid 748] <... write resumed>) = 262144 [pid 746] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 745] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 756] <... futex resumed>) = 0 [pid 749] munmap(0x7f35d66dd000, 262144 [pid 748] munmap(0x7f35d66dd000, 262144 [pid 746] <... futex resumed>) = 1 [pid 745] <... futex resumed>) = 0 [pid 739] exit_group(0 [pid 757] <... open resumed>) = 4 [pid 756] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 755] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 754] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 753] <... ioctl resumed>) = 0 [pid 749] <... munmap resumed>) = 0 [pid 748] <... munmap resumed>) = 0 [pid 747] <... futex resumed>) = 0 [pid 744] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 755] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 754] <... open resumed>) = 6 [pid 753] close(4 [pid 747] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 746] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 745] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 744] <... futex resumed>) = 0 [pid 739] <... exit_group resumed>) = ? [pid 756] <... open resumed>) = 4 [pid 755] <... open resumed>) = 5 [pid 754] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 753] <... close resumed>) = 0 [pid 749] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 748] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 747] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 744] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 743] <... futex resumed>) = ? [pid 742] <... futex resumed>) = ? [pid 755] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 754] <... futex resumed>) = 0 [pid 753] mkdir("./file1", 0777 [pid 747] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 744] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 743] +++ exited with 0 +++ [pid 755] <... futex resumed>) = 0 [pid 754] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 753] <... mkdir resumed>) = 0 [pid 747] <... futex resumed>) = 0 [pid 744] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 742] +++ exited with 0 +++ [pid 739] +++ exited with 0 +++ [pid 757] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 756] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 755] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 753] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 749] <... openat resumed>) = 5 [pid 748] <... openat resumed>) = 5 [pid 747] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 744] <... futex resumed>) = 0 [pid 738] +++ exited with 0 +++ [pid 744] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=739, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 757] <... futex resumed>) = 1 [pid 756] <... futex resumed>) = 1 [pid 754] <... write resumed>) = 262144 [pid 749] ioctl(5, LOOP_SET_FD, 3 [pid 748] ioctl(5, LOOP_SET_FD, 3 [pid 746] <... futex resumed>) = 0 [pid 745] <... futex resumed>) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=738, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 755] <... write resumed>) = 262144 [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 757] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 756] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 754] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 753] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 754] <... futex resumed>) = 1 [pid 747] <... futex resumed>) = 0 [pid 754] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 746] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 745] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 750] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 750] ioctl(4, LOOP_CLR_FD [pid 295] <... restart_syscall resumed>) = 0 [pid 756] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 745] <... futex resumed>) = 0 [pid 750] <... ioctl resumed>) = 0 [pid 750] close(4 [pid 756] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 746] <... futex resumed>) = 0 [pid 745] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 750] <... close resumed>) = 0 [pid 750] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 29.329074][ T750] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.329074][ T750] [ 29.331670][ T753] loop2: detected capacity change from 0 to 512 [ 29.362717][ T753] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [ 29.369318][ T750] EXT4-fs warning (device loop1): read_mmp_block:115: Error -117 while reading MMP block 8 [ 29.380325][ T748] loop3: detected capacity change from 0 to 512 [pid 750] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 757] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 756] <... mount resumed>) = 0 [pid 755] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 753] ioctl(5, LOOP_CLR_FD [pid 748] <... ioctl resumed>) = 0 [pid 746] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 756] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 755] <... futex resumed>) = 1 [pid 746] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 744] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 756] <... futex resumed>) = 0 [pid 755] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 746] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 744] exit_group(0 [pid 299] <... openat resumed>) = 3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 756] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 755] <... futex resumed>) = ? [pid 750] <... futex resumed>) = ? [pid 749] <... ioctl resumed>) = 0 [pid 746] <... futex resumed>) = 0 [pid 744] <... exit_group resumed>) = ? [pid 299] fstat(3, [pid 295] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 753] <... ioctl resumed>) = 0 [pid 757] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 749] close(3 [pid 748] close(3 [pid 756] <... open resumed>) = 6 [pid 757] <... mount resumed>) = 0 [pid 756] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 755] +++ exited with 0 +++ [pid 753] close(5 [pid 750] +++ exited with 0 +++ [pid 749] <... close resumed>) = 0 [pid 748] <... close resumed>) = 0 [pid 746] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... openat resumed>) = 3 [pid 299] getdents64(3, [pid 295] fstat(3, [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 756] <... futex resumed>) = 0 [pid 746] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] <... umount2 resumed>) = 0 [pid 295] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 756] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 746] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 746] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] lstat("./19/bus", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] lstat("./17/bus", [pid 299] unlink("./19/bus" [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] <... unlink resumed>) = 0 [pid 299] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] unlink("./17/bus" [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... unlink resumed>) = 0 [pid 299] lstat("./19/binderfs", [pid 295] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 746] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] unlink("./19/binderfs" [pid 748] mkdir("./file1", 0777 [pid 295] lstat("./17/binderfs", [pid 299] <... unlink resumed>) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 748] <... mkdir resumed>) = 0 [pid 748] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 749] mkdir("./file1", 0777 [pid 295] unlink("./17/binderfs") = 0 [pid 756] <... write resumed>) = 262144 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] lstat("./19/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 756] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 749] <... mkdir resumed>) = 0 [pid 749] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 299] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 756] <... futex resumed>) = 1 [pid 746] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 4 [pid 299] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 753] <... close resumed>) = 0 [pid 299] getdents64(4, [pid 757] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 756] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 744] +++ exited with 0 +++ [pid 745] <... futex resumed>) = 0 [pid 745] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 745] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 757] <... futex resumed>) = 1 [pid 757] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 3 [pid 757] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 745] <... futex resumed>) = 0 [pid 745] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 745] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 757] <... futex resumed>) = 1 [pid 757] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 753] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 753] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=744, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 747] exit_group(0 [pid 754] <... futex resumed>) = ? [pid 747] <... exit_group resumed>) = ? [pid 754] +++ exited with 0 +++ [pid 748] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 299] getdents64(4, [pid 753] <... futex resumed>) = ? [pid 748] ioctl(5, LOOP_CLR_FD [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 748] <... ioctl resumed>) = 0 [pid 299] close(4 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 748] close(5 [pid 299] rmdir("./19/file1" [pid 748] <... close resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 299] <... rmdir resumed>) = 0 [pid 748] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] fstat(3, [pid 748] <... futex resumed>) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(3, [pid 748] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] getdents64(3, [pid 746] exit_group(0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 756] <... futex resumed>) = ? [pid 748] <... futex resumed>) = ? [pid 746] <... exit_group resumed>) = ? [pid 296] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 756] +++ exited with 0 +++ [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3 [pid 296] <... umount2 resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 296] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] rmdir("./19" [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 757] <... write resumed>) = 262144 [pid 299] <... rmdir resumed>) = 0 [pid 296] lstat("./16/bus", [pid 299] mkdir("./20", 0777 [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 757] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... mkdir resumed>) = 0 [pid 296] unlink("./16/bus" [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 296] <... unlink resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] ioctl(3, LOOP_CLR_FD [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] lstat("./16/binderfs", [pid 299] close(3 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] <... close resumed>) = 0 [ 29.381439][ T749] loop5: detected capacity change from 0 to 512 [ 29.400989][ T749] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 29.400989][ T749] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.400989][ T749] [ 29.401290][ T748] EXT4-fs (loop3): VFS: Can't find ext4 filesystem [pid 296] unlink("./16/binderfs" [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... unlink resumed>) = 0 [pid 296] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 759 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./16/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 ./strace-static-x86_64: Process 759 attached [pid 757] <... futex resumed>) = 1 [pid 749] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 745] <... futex resumed>) = 0 [pid 296] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 759] set_robust_list(0x555556c9c5e0, 24 [pid 757] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 759] <... set_robust_list resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 759] chdir("./20" [pid 296] openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 759] <... chdir resumed>) = 0 [pid 296] <... openat resumed>) = 4 [pid 759] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] fstat(4, [pid 759] <... prctl resumed>) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 759] setpgid(0, 0 [pid 296] getdents64(4, [pid 759] <... setpgid resumed>) = 0 [pid 759] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, [pid 759] <... openat resumed>) = 3 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 759] write(3, "1000", 4) = 4 [pid 759] close(3) = 0 [pid 296] close(4 [pid 759] symlink("/dev/binderfs", "./binderfs" [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./16/file1" [pid 759] <... symlink resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 759] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] getdents64(3, [pid 759] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 759] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 296] close(3 [pid 759] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 749] ioctl(5, LOOP_CLR_FD [pid 296] <... close resumed>) = 0 [pid 759] <... mprotect resumed>) = 0 [pid 749] <... ioctl resumed>) = 0 [pid 296] rmdir("./16" [pid 759] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 749] close(5) = 0 [pid 759] <... clone resumed>, parent_tid=[760], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 760 [pid 749] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 759] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 749] <... futex resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./17", 0777 [pid 759] <... futex resumed>) = 0 [pid 749] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 759] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 759] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 759] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 296] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 759] <... mprotect resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 759] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 759] <... clone resumed>, parent_tid=[761], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 761 [pid 745] exit_group(0 [pid 759] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 757] <... futex resumed>) = ? [pid 749] <... futex resumed>) = ? [pid 745] <... exit_group resumed>) = ? [pid 296] close(3./strace-static-x86_64: Process 761 attached ./strace-static-x86_64: Process 760 attached [pid 759] <... futex resumed>) = 0 [pid 757] +++ exited with 0 +++ [pid 296] <... close resumed>) = 0 [pid 759] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 761] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 761] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 761] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 761] <... futex resumed>) = 1 [pid 759] <... futex resumed>) = 0 [pid 761] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 759] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 761] <... futex resumed>) = 0 [pid 759] <... futex resumed>) = 1 [pid 761] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 759] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 761] <... mount resumed>) = 0 [pid 761] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 759] <... futex resumed>) = 0 [pid 761] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 759] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 761] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 759] <... futex resumed>) = 0 [pid 761] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 759] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 761] <... open resumed>) = 4 [pid 761] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 759] <... futex resumed>) = 0 [pid 761] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 759] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 761] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 759] <... futex resumed>) = 0 [pid 761] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 759] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 761] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 761] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 759] <... futex resumed>) = 0 [pid 761] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 760] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 760] memfd_create("syzkaller", 0) = 5 [pid 760] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 ./strace-static-x86_64: Process 762 attached [pid 762] set_robust_list(0x555556c9c5e0, 24 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 762 [pid 762] <... set_robust_list resumed>) = 0 [pid 760] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 762] chdir("./17") = 0 [pid 760] <... write resumed>) = 262144 [pid 762] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 760] munmap(0x7f35d66dd000, 262144 [pid 762] <... prctl resumed>) = 0 [pid 760] <... munmap resumed>) = 0 [pid 762] setpgid(0, 0) = 0 [pid 760] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 762] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 760] <... openat resumed>) = 6 [pid 762] <... openat resumed>) = 3 [pid 762] write(3, "1000", 4) = 4 [pid 760] ioctl(6, LOOP_SET_FD, 5 [pid 762] close(3) = 0 [pid 762] symlink("/dev/binderfs", "./binderfs") = 0 [pid 762] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 762] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 762] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 762] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[763], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 763 [pid 762] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 762] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 762] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 762] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 762] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[764], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 764 [pid 762] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 762] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 763 attached [pid 763] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 763] memfd_create("syzkaller", 0) = 3 [pid 763] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 763] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 763] munmap(0x7f35d66dd000, 262144) = 0 ./strace-static-x86_64: Process 764 attached [pid 760] <... ioctl resumed>) = 0 [pid 763] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 764] set_robust_list(0x7f35deafd9e0, 24 [pid 763] ioctl(4, LOOP_SET_FD, 3 [pid 760] close(5 [pid 764] <... set_robust_list resumed>) = 0 [pid 764] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5 [pid 764] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 762] <... futex resumed>) = 0 [pid 762] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 762] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 764] <... futex resumed>) = 1 [pid 764] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 764] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 762] <... futex resumed>) = 0 [pid 762] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 762] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 764] <... futex resumed>) = 1 [pid 764] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 760] <... close resumed>) = 0 [pid 760] mkdir("./file1", 0777) = 0 [pid 760] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 763] <... ioctl resumed>) = 0 [pid 748] +++ exited with 0 +++ [pid 746] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=746, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 298] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 763] close(3) = 0 [pid 763] mkdir("./file1", 0777) = 0 [pid 763] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 764] <... open resumed>) = 6 [pid 764] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 764] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 762] <... futex resumed>) = 0 [pid 762] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 764] <... futex resumed>) = 0 [pid 762] <... futex resumed>) = 1 [pid 764] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [ 29.437633][ T749] EXT4-fs (loop5): Magic mismatch, very weird! [ 29.455724][ T760] loop4: detected capacity change from 0 to 512 [ 29.462629][ T763] loop1: detected capacity change from 0 to 512 [ 29.465699][ T760] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 29.465699][ T760] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.465699][ T760] [pid 762] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 753] +++ exited with 0 +++ [pid 749] +++ exited with 0 +++ [pid 747] +++ exited with 0 +++ [pid 745] +++ exited with 0 +++ [pid 295] <... umount2 resumed>) = 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=745, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=747, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./17/file1", [pid 300] umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 295] openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] fstat(3, [pid 297] fstat(3, [pid 295] <... openat resumed>) = 4 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] fstat(4, [pid 300] getdents64(3, [pid 297] getdents64(3, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] getdents64(4, [pid 300] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./17/file1") = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./17") = 0 [pid 295] mkdir("./18", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 765 ./strace-static-x86_64: Process 765 attached [pid 765] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 765] chdir("./18") = 0 [pid 765] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 765] setpgid(0, 0) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 300] <... umount2 resumed>) = 0 [pid 298] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 300] umount2("./16/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 765] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./18/bus", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 765] write(3, "1000", 4) = 4 [pid 300] lstat("./16/bus", [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] lstat("./18/bus", [pid 765] close(3) = 0 [pid 764] <... write resumed>) = 262144 [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] unlink("./18/bus" [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 764] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] unlink("./16/bus" [pid 298] <... unlink resumed>) = 0 [pid 297] unlink("./18/bus" [pid 765] symlink("/dev/binderfs", "./binderfs" [pid 764] <... futex resumed>) = 1 [pid 762] <... futex resumed>) = 0 [pid 300] <... unlink resumed>) = 0 [pid 298] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... unlink resumed>) = 0 [pid 764] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./18/binderfs", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./16/binderfs", [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] lstat("./18/binderfs", [pid 765] <... symlink resumed>) = 0 [pid 765] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] unlink("./18/binderfs" [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 765] <... futex resumed>) = 0 [pid 300] unlink("./16/binderfs" [pid 298] <... unlink resumed>) = 0 [pid 297] unlink("./18/binderfs" [pid 765] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] <... unlink resumed>) = 0 [pid 298] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... unlink resumed>) = 0 [pid 765] <... mmap resumed>) = 0x7f35deafe000 [pid 300] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 765] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./18/file1", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 765] <... mprotect resumed>) = 0 [pid 300] lstat("./16/file1", [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] lstat("./18/file1", [pid 765] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 29.486544][ T763] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 29.486544][ T763] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.486544][ T763] [pid 298] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 ./strace-static-x86_64: Process 768 attached [pid 300] umount2("./16/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 765] <... clone resumed>, parent_tid=[768], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 768 [pid 765] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 765] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 765] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 765] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 765] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[769], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 769 [pid 765] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 765] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 768] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 768] memfd_create("syzkaller", 0) = 3 [pid 768] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 768] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 768] munmap(0x7f35d66dd000, 262144 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... openat resumed>) = 4 [pid 298] <... openat resumed>) = 4 [pid 300] <... openat resumed>) = 4 [pid 298] fstat(4, [pid 297] fstat(4, [pid 300] fstat(4, [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 768] <... munmap resumed>) = 0 [pid 300] getdents64(4, [pid 297] getdents64(4, [pid 298] getdents64(4, [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, [pid 300] getdents64(4, [pid 298] getdents64(4, [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4 [pid 300] close(4 [pid 298] close(4 [pid 300] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 300] rmdir("./16/file1" [pid 298] <... close resumed>) = 0 [pid 297] rmdir("./18/file1" [pid 768] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 768] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 769 attached [pid 300] <... rmdir resumed>) = 0 [pid 298] rmdir("./18/file1" [pid 297] <... rmdir resumed>) = 0 [pid 768] <... ioctl resumed>) = 0 [pid 768] close(3) = 0 [pid 768] mkdir("./file1", 0777) = 0 [ 29.533839][ T763] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 29.545987][ T760] EXT4-fs (loop4): 1 orphan inode deleted [ 29.547016][ T768] loop0: detected capacity change from 0 to 512 [ 29.552148][ T760] EXT4-fs (loop4): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [pid 768] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 300] getdents64(3, [pid 298] <... rmdir resumed>) = 0 [pid 297] getdents64(3, [pid 763] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 763] ioctl(4, LOOP_CLR_FD) = 0 [pid 763] close(4 [pid 765] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 765] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 765] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35d66fc000 [pid 765] mprotect(0x7f35d66fd000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 765] clone(child_stack=0x7f35d671c3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[770], tls=0x7f35d671c700, child_tidptr=0x7f35d671c9d0) = 770 [pid 765] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 765] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 763] <... close resumed>) = 0 [pid 763] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 763] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 770 attached [pid 769] set_robust_list(0x7f35deafd9e0, 24 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] getdents64(3, [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 770] set_robust_list(0x7f35d671c9e0, 24 [pid 769] <... set_robust_list resumed>) = 0 [pid 762] exit_group(0 [pid 300] close(3 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] close(3 [pid 770] <... set_robust_list resumed>) = 0 [pid 769] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 762] <... exit_group resumed>) = ? [pid 300] <... close resumed>) = 0 [pid 770] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 764] <... futex resumed>) = ? [pid 763] <... futex resumed>) = ? [pid 297] <... close resumed>) = 0 [pid 770] <... mount resumed>) = 0 [pid 769] <... open resumed>) = 3 [pid 764] +++ exited with 0 +++ [pid 763] +++ exited with 0 +++ [pid 298] close(3 [pid 297] rmdir("./18" [pid 760] <... mount resumed>) = 0 [pid 762] +++ exited with 0 +++ [pid 300] rmdir("./16" [pid 760] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 297] <... rmdir resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=762, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 770] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 769] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] mkdir("./17", 0777 [pid 298] rmdir("./18" [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 297] mkdir("./19", 0777 [pid 770] <... futex resumed>) = 1 [pid 769] <... futex resumed>) = 0 [pid 765] <... futex resumed>) = 0 [pid 765] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... mkdir resumed>) = 0 [pid 296] <... restart_syscall resumed>) = 0 [pid 765] <... futex resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 765] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 770] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 769] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 298] mkdir("./19", 0777 [pid 297] <... mkdir resumed>) = 0 [pid 296] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW [pid 769] <... open resumed>) = 5 [pid 760] <... openat resumed>) = 5 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] <... mkdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 769] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... openat resumed>) = 3 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 297] <... openat resumed>) = 3 [pid 296] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 769] <... futex resumed>) = 1 [pid 765] <... futex resumed>) = 0 [pid 300] ioctl(3, LOOP_CLR_FD [pid 298] <... openat resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] <... openat resumed>) = 3 [pid 769] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 765] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] fstat(3, [pid 765] <... futex resumed>) = 0 [pid 760] chdir("./file1" [pid 300] close(3 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 769] <... write resumed>) = 262144 [pid 765] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 760] <... chdir resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 298] close(3 [pid 297] <... close resumed>) = 0 [pid 296] getdents64(3, [pid 769] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 769] <... futex resumed>) = 1 [pid 765] <... futex resumed>) = 0 [pid 769] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 ./strace-static-x86_64: Process 771 attached [pid 760] ioctl(6, LOOP_CLR_FD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 771 [pid 296] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 772 [pid 296] <... umount2 resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 773 [ 29.560411][ T763] EXT4-fs (loop1): group descriptors corrupted! [ 29.581502][ T768] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 29.581502][ T768] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.581502][ T768] [ 29.593457][ T760] ext4 filesystem being mounted at /root/syzkaller.RJEgPO/20/file1 supports timestamps until 2038 (0x7fffffff) [pid 296] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 773 attached ./strace-static-x86_64: Process 772 attached [pid 771] set_robust_list(0x555556c9c5e0, 24 [pid 760] <... ioctl resumed>) = 0 [pid 771] <... set_robust_list resumed>) = 0 [pid 760] close(6 [pid 771] chdir("./19" [pid 760] <... close resumed>) = 0 [pid 768] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 773] set_robust_list(0x555556c9c5e0, 24 [pid 771] <... chdir resumed>) = 0 [pid 760] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 760] <... futex resumed>) = 0 [pid 759] exit_group(0 [pid 772] set_robust_list(0x555556c9c5e0, 24 [pid 771] <... prctl resumed>) = 0 [pid 760] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] lstat("./17/bus", [pid 773] <... set_robust_list resumed>) = 0 [pid 772] <... set_robust_list resumed>) = 0 [pid 771] setpgid(0, 0 [pid 768] ioctl(4, LOOP_CLR_FD [pid 761] <... futex resumed>) = ? [pid 760] <... futex resumed>) = ? [pid 759] <... exit_group resumed>) = ? [pid 771] <... setpgid resumed>) = 0 [pid 761] +++ exited with 0 +++ [pid 760] +++ exited with 0 +++ [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 773] chdir("./19" [pid 772] chdir("./17" [pid 771] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 768] <... ioctl resumed>) = 0 [pid 296] unlink("./17/bus" [pid 759] +++ exited with 0 +++ [pid 773] <... chdir resumed>) = 0 [pid 772] <... chdir resumed>) = 0 [pid 771] <... openat resumed>) = 3 [pid 768] close(4 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=759, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 296] <... unlink resumed>) = 0 [pid 772] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 771] write(3, "1000", 4 [pid 296] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 772] <... prctl resumed>) = 0 [pid 771] <... write resumed>) = 4 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 772] setpgid(0, 0 [pid 771] close(3 [pid 299] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] lstat("./17/binderfs", [pid 772] <... setpgid resumed>) = 0 [pid 771] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 772] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 771] symlink("/dev/binderfs", "./binderfs" [pid 299] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] unlink("./17/binderfs" [pid 772] <... openat resumed>) = 3 [pid 771] <... symlink resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] <... unlink resumed>) = 0 [pid 772] write(3, "1000", 4 [pid 771] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] fstat(3, [pid 296] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 772] <... write resumed>) = 4 [pid 771] <... futex resumed>) = 0 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 772] close(3 [pid 771] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] getdents64(3, [pid 296] lstat("./17/file1", [pid 773] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 772] <... close resumed>) = 0 [pid 771] <... mmap resumed>) = 0x7f35deafe000 [pid 768] <... close resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 772] symlink("/dev/binderfs", "./binderfs" [pid 771] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 299] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 772] <... symlink resumed>) = 0 [pid 771] <... mprotect resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 772] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 299] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 772] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... openat resumed>) = 4 [pid 772] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 771] <... clone resumed>, parent_tid=[774], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 774 [pid 299] lstat("./20/bus", [pid 296] fstat(4, [pid 772] <... mmap resumed>) = 0x7f35deafe000 [pid 771] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 772] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 771] <... futex resumed>) = 0 [pid 299] unlink("./20/bus" [pid 296] getdents64(4, ./strace-static-x86_64: Process 774 attached [pid 773] <... prctl resumed>) = 0 [pid 772] <... mprotect resumed>) = 0 [pid 771] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 768] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... unlink resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 774] set_robust_list(0x7f35deb1e9e0, 24 [pid 773] setpgid(0, 0 [pid 772] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 771] <... futex resumed>) = 0 [pid 768] <... futex resumed>) = 0 [pid 765] exit_group(0 [pid 299] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(4, [pid 774] <... set_robust_list resumed>) = 0 [pid 773] <... setpgid resumed>) = 0 [pid 770] <... futex resumed>) = ? [pid 769] <... futex resumed>) = ? [pid 765] <... exit_group resumed>) = ? [pid 768] read(-256, ) = ? [pid 774] memfd_create("syzkaller", 0 [pid 773] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 771] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 770] +++ exited with 0 +++ [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 769] +++ exited with 0 +++ [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 774] <... memfd_create resumed>) = 3 [pid 773] <... openat resumed>) = 3 [pid 774] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 773] write(3, "1000", 4 [pid 774] <... mmap resumed>) = 0x7f35d66fe000 [pid 773] <... write resumed>) = 4 [pid 773] close(3 [pid 772] <... clone resumed>, parent_tid=[775], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 775 [pid 771] <... mmap resumed>) = 0x7f35d66dd000 [pid 299] lstat("./20/binderfs", [pid 296] close(4 [pid 773] <... close resumed>) = 0 [pid 772] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] mprotect(0x7f35d66de000, 131072, PROT_READ|PROT_WRITE [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] <... close resumed>) = 0 [pid 773] symlink("/dev/binderfs", "./binderfs" [pid 772] <... futex resumed>) = 0 [pid 771] <... mprotect resumed>) = 0 [pid 299] unlink("./20/binderfs" [pid 296] rmdir("./17/file1" [pid 773] <... symlink resumed>) = 0 [pid 772] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 771] clone(child_stack=0x7f35d66fd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 299] <... unlink resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 775 attached [pid 774] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 773] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 772] <... futex resumed>) = 0 [pid 773] <... futex resumed>) = 0 [pid 772] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 771] <... clone resumed>, parent_tid=[776], tls=0x7f35d66fd700, child_tidptr=0x7f35d66fd9d0) = 776 [pid 299] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(3, ./strace-static-x86_64: Process 776 attached [pid 775] set_robust_list(0x7f35deb1e9e0, 24 [pid 774] <... write resumed>) = 262144 [pid 773] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 772] <... mmap resumed>) = 0x7f35deadd000 [pid 771] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 776] set_robust_list(0x7f35d66fd9e0, 24 [pid 775] <... set_robust_list resumed>) = 0 [pid 774] munmap(0x7f35d66fe000, 262144 [pid 773] <... mmap resumed>) = 0x7f35deafe000 [pid 771] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 776] <... set_robust_list resumed>) = 0 [pid 775] memfd_create("syzkaller", 0 [pid 774] <... munmap resumed>) = 0 [pid 773] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 772] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 771] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] close(3 [pid 776] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 775] <... memfd_create resumed>) = 3 [pid 774] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 773] <... mprotect resumed>) = 0 [pid 772] <... mprotect resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 775] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 774] <... openat resumed>) = 5 [pid 773] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 772] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [ 29.628992][ T768] EXT4-fs warning (device loop0): read_mmp_block:115: Error -117 while reading MMP block 8 [pid 296] rmdir("./17" [pid 776] <... open resumed>) = 4 [pid 775] <... mmap resumed>) = 0x7f35d66dd000 [pid 774] ioctl(5, LOOP_SET_FD, 3 [pid 296] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 777 attached [pid 772] <... clone resumed>, parent_tid=[778], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 778 [pid 296] mkdir("./18", 0777 [pid 772] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... mkdir resumed>) = 0 [pid 772] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 772] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... openat resumed>) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 775] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 779 ./strace-static-x86_64: Process 779 attached [pid 779] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 779] chdir("./18") = 0 [pid 779] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 779] setpgid(0, 0) = 0 ./strace-static-x86_64: Process 778 attached [pid 778] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 778] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 779] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 778] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 772] <... futex resumed>) = 0 [pid 772] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 772] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 778] <... futex resumed>) = 1 [pid 779] write(3, "1000", 4 [pid 778] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 779] <... write resumed>) = 4 [pid 778] <... mount resumed>) = 0 [pid 779] close(3) = 0 [pid 779] symlink("/dev/binderfs", "./binderfs") = 0 [pid 778] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 772] <... futex resumed>) = 0 [pid 772] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 772] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 778] <... futex resumed>) = 1 [pid 778] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 778] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 772] <... futex resumed>) = 0 [pid 772] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 772] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 778] <... futex resumed>) = 1 [pid 778] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 779] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 778] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 779] <... futex resumed>) = 0 [pid 772] <... futex resumed>) = 0 [pid 778] <... futex resumed>) = 1 [pid 779] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 778] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 779] <... mmap resumed>) = 0x7f35deafe000 [pid 779] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 779] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[780], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 780 [pid 779] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 779] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 779] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 779] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 773] <... clone resumed>, parent_tid=[777], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 777 [pid 779] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 773] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 779] <... clone resumed>, parent_tid=[781], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 781 [pid 773] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 773] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 779] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 773] <... mmap resumed>) = 0x7f35deadd000 [pid 776] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 773] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 779] <... futex resumed>) = 0 [pid 773] <... mprotect resumed>) = 0 [pid 776] <... futex resumed>) = 1 [pid 771] <... futex resumed>) = 0 [pid 773] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 771] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 776] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 771] <... futex resumed>) = 0 [pid 773] <... clone resumed>, parent_tid=[782], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 782 [pid 771] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 779] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 776] <... mount resumed>) = 0 [pid 773] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 776] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 773] <... futex resumed>) = 0 [pid 776] <... futex resumed>) = 1 [pid 775] <... write resumed>) = 262144 [pid 773] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 771] <... futex resumed>) = 0 [pid 776] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 775] munmap(0x7f35d66dd000, 262144 [pid 771] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 776] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 771] <... futex resumed>) = 0 ./strace-static-x86_64: Process 781 attached [pid 776] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 771] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 781] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 775] <... munmap resumed>) = 0 [pid 775] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 777] set_robust_list(0x7f35deb1e9e0, 24 [pid 776] <... open resumed>) = 6 [pid 775] <... openat resumed>) = 6 [pid 776] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 775] ioctl(6, LOOP_SET_FD, 3./strace-static-x86_64: Process 782 attached [pid 777] <... set_robust_list resumed>) = 0 [pid 774] <... ioctl resumed>) = 0 [pid 781] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 776] <... futex resumed>) = 1 [pid 771] <... futex resumed>) = 0 [pid 781] <... open resumed>) = 3 [pid 781] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 779] <... futex resumed>) = 0 [pid 779] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 779] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 781] <... futex resumed>) = 1 [pid 781] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 781] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 779] <... futex resumed>) = 0 [pid 779] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 779] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 781] <... futex resumed>) = 1 ./strace-static-x86_64: Process 780 attached [pid 782] set_robust_list(0x7f35deafd9e0, 24 [pid 781] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 777] memfd_create("syzkaller", 0 [pid 776] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 775] <... ioctl resumed>) = 0 [pid 774] close(3 [pid 771] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 782] <... set_robust_list resumed>) = 0 [pid 777] <... memfd_create resumed>) = 3 [pid 775] close(3 [pid 774] <... close resumed>) = 0 [pid 771] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 782] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 777] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 776] <... write resumed>) = 262144 [pid 775] <... close resumed>) = 0 [pid 774] mkdir("./file1", 0777 [pid 771] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 768] +++ exited with 0 +++ [pid 765] +++ exited with 0 +++ [pid 299] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 782] <... open resumed>) = 4 [pid 780] set_robust_list(0x7f35deb1e9e0, 24 [pid 777] <... mmap resumed>) = 0x7f35d66dd000 [pid 776] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 775] mkdir("./file1", 0777 [pid 774] <... mkdir resumed>) = 0 [pid 771] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 782] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 781] <... open resumed>) = 4 [pid 780] <... set_robust_list resumed>) = 0 [pid 777] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 776] <... futex resumed>) = 0 [pid 774] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 299] lstat("./20/file1", [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=765, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 782] <... futex resumed>) = 1 [pid 781] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 776] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 773] <... futex resumed>) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 781] <... futex resumed>) = 1 [pid 779] <... futex resumed>) = 0 [pid 299] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 781] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 779] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 777] <... write resumed>) = 262144 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 781] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 779] <... futex resumed>) = 0 [pid 773] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "./20/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... openat resumed>) = 3 [pid 781] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 779] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... openat resumed>) = 4 [pid 295] fstat(3, [pid 781] <... futex resumed>) = 0 [pid 779] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] fstat(4, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 781] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, [pid 782] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 777] munmap(0x7f35d66dd000, 262144 [pid 773] <... futex resumed>) = 0 [pid 299] getdents64(4, [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./20/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./20") = 0 [pid 299] mkdir("./21", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 782] <... mount resumed>) = 0 [pid 777] <... munmap resumed>) = 0 [pid 773] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 782] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 777] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 775] <... mkdir resumed>) = 0 [pid 773] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 782] <... futex resumed>) = 0 [pid 777] <... openat resumed>) = 5 [pid 775] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 773] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 782] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 777] ioctl(5, LOOP_SET_FD, 3 [pid 773] <... futex resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 783 [pid 295] lstat("./18/bus", [pid 782] <... open resumed>) = 6 [pid 773] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] unlink("./18/bus") = 0 [pid 295] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./18/binderfs") = 0 [pid 295] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./18/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./18/file1") = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./18") = 0 [pid 295] mkdir("./19", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [ 29.665090][ T774] loop2: detected capacity change from 0 to 512 [ 29.674525][ T775] loop5: detected capacity change from 0 to 512 [ 29.697570][ T774] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [ 29.705557][ T777] loop3: detected capacity change from 0 to 512 [pid 295] close(3 [pid 782] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... close resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 784 ./strace-static-x86_64: Process 783 attached [pid 783] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 783] chdir("./21") = 0 [pid 783] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 783] setpgid(0, 0) = 0 [pid 783] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 783] write(3, "1000", 4) = 4 [pid 783] close(3) = 0 [pid 783] symlink("/dev/binderfs", "./binderfs") = 0 [pid 783] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 783] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 783] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 783] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[785], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 785 [pid 783] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 783] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 783] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 783] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 783] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[786], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 786 [pid 783] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 783] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 784 attached [pid 784] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 784] chdir("./19") = 0 [pid 784] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 784] setpgid(0, 0) = 0 [pid 784] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 784] write(3, "1000", 4) = 4 [pid 784] close(3) = 0 [pid 784] symlink("/dev/binderfs", "./binderfs") = 0 [pid 784] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 784] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 784] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 784] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[787], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 787 [pid 784] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 784] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 784] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 784] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 784] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[788], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 788 [pid 784] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 784] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 786 attached [pid 786] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 786] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 786] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 783] <... futex resumed>) = 0 [pid 783] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 783] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 786] <... futex resumed>) = 1 [pid 786] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 786] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 783] <... futex resumed>) = 0 [pid 783] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 783] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 786] <... futex resumed>) = 1 [pid 786] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 786] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 783] <... futex resumed>) = 0 [pid 783] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 783] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 786] <... futex resumed>) = 1 [pid 786] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 786] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 783] <... futex resumed>) = 0 [pid 786] <... futex resumed>) = 1 [pid 786] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 787 attached [pid 787] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 787] memfd_create("syzkaller", 0) = 3 [pid 787] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 787] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 782] <... futex resumed>) = 1 [pid 782] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 773] <... futex resumed>) = 0 [pid 773] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 782] <... futex resumed>) = 0 [pid 773] <... futex resumed>) = 1 [pid 782] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 773] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 787] <... write resumed>) = 262144 [pid 787] munmap(0x7f35d66dd000, 262144) = 0 [pid 787] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 787] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 788 attached ./strace-static-x86_64: Process 785 attached [pid 780] memfd_create("syzkaller", 0 [pid 777] <... ioctl resumed>) = 0 [pid 774] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 787] <... ioctl resumed>) = 0 [pid 787] close(3) = 0 [pid 787] mkdir("./file1", 0777) = 0 [ 29.712045][ T775] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 29.712045][ T775] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.712045][ T775] [ 29.732798][ T782] blk_update_request: I/O error, dev loop3, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 29.733162][ T787] loop0: detected capacity change from 0 to 512 [ 29.744208][ T782] Buffer I/O error on dev loop3, logical block 0, lost async page write [pid 787] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 788] set_robust_list(0x7f35deafd9e0, 24 [pid 785] set_robust_list(0x7f35deb1e9e0, 24 [pid 780] <... memfd_create resumed>) = 5 [pid 777] close(3 [pid 774] ioctl(5, LOOP_CLR_FD [pid 788] <... set_robust_list resumed>) = 0 [pid 784] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 785] <... set_robust_list resumed>) = 0 [pid 780] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 777] <... close resumed>) = 0 [pid 774] <... ioctl resumed>) = 0 [pid 784] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 780] <... mmap resumed>) = 0x7f35d66dd000 [pid 777] mkdir("./file1", 0777 [pid 774] close(5 [pid 788] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 784] <... futex resumed>) = 0 [pid 784] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35d66fc000 [pid 784] mprotect(0x7f35d66fd000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 784] clone(child_stack=0x7f35d671c3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[789], tls=0x7f35d671c700, child_tidptr=0x7f35d671c9d0) = 789 [pid 784] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 784] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 789 attached [pid 789] set_robust_list(0x7f35d671c9e0, 24) = 0 [pid 789] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = -1 ENOENT (No such file or directory) [pid 789] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 784] <... futex resumed>) = 0 [pid 784] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 780] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 774] <... close resumed>) = 0 [pid 789] <... futex resumed>) = 1 [pid 788] <... open resumed>) = 3 [pid 785] memfd_create("syzkaller", 0 [pid 784] <... futex resumed>) = 0 [pid 782] <... write resumed>) = -1 EIO (Input/output error) [pid 780] <... write resumed>) = 262144 [pid 777] <... mkdir resumed>) = 0 [pid 774] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 773] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 789] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 788] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 785] <... memfd_create resumed>) = 5 [pid 784] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 782] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 780] munmap(0x7f35d66dd000, 262144 [pid 777] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 774] <... futex resumed>) = 0 [pid 771] exit_group(0 [pid 788] <... futex resumed>) = 0 [pid 785] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 782] <... futex resumed>) = 0 [pid 788] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 785] <... mmap resumed>) = 0x7f35d66dd000 [pid 782] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 780] <... munmap resumed>) = 0 [pid 776] <... futex resumed>) = ? [pid 771] <... exit_group resumed>) = ? [pid 776] +++ exited with 0 +++ [pid 774] +++ exited with 0 +++ [pid 789] <... open resumed>) = 5 [pid 789] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 784] <... futex resumed>) = 0 [pid 784] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 784] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 771] +++ exited with 0 +++ [pid 788] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 788] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=771, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 789] <... futex resumed>) = 1 [pid 789] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 780] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 6 [pid 297] <... restart_syscall resumed>) = 0 [pid 780] ioctl(6, LOOP_SET_FD, 5 [pid 785] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 780] <... ioctl resumed>) = 0 [pid 297] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 785] <... write resumed>) = 262144 [pid 297] <... openat resumed>) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 780] close(5) = 0 [pid 780] mkdir("./file1", 0777) = 0 [pid 780] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 297] <... umount2 resumed>) = 0 [ 29.752354][ T787] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 29.752354][ T787] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.752354][ T787] [ 29.787872][ T780] loop1: detected capacity change from 0 to 512 [ 29.795562][ T777] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 29.795562][ T777] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.795562][ T777] [pid 297] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 785] munmap(0x7f35d66dd000, 262144 [pid 297] lstat("./19/bus", [pid 785] <... munmap resumed>) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 784] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 785] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] unlink("./19/bus" [pid 785] <... openat resumed>) = 6 [pid 297] <... unlink resumed>) = 0 [pid 785] ioctl(6, LOOP_SET_FD, 5 [pid 297] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./19/binderfs", [pid 785] <... ioctl resumed>) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 29.814402][ T780] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 29.814402][ T780] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.814402][ T780] [ 29.834176][ T777] EXT4-fs (loop3): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 29.845724][ T785] loop4: detected capacity change from 0 to 512 [ 29.852665][ T775] EXT4-fs (loop5): 1 orphan inode deleted [pid 297] unlink("./19/binderfs" [pid 785] close(5 [pid 297] <... unlink resumed>) = 0 [ 29.858791][ T775] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 29.882306][ T787] EXT4-fs (loop0): 1 orphan inode deleted [ 29.887689][ T780] EXT4-fs (loop1): 1 orphan inode deleted [ 29.888692][ T787] EXT4-fs (loop0): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [pid 297] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./19/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./19/file1") = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./19") = 0 [pid 297] mkdir("./20", 0777) = 0 [pid 779] exit_group(0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 781] <... futex resumed>) = ? [pid 779] <... exit_group resumed>) = ? [pid 297] <... openat resumed>) = 3 [pid 781] +++ exited with 0 +++ [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 796 ./strace-static-x86_64: Process 796 attached [pid 796] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 796] chdir("./20") = 0 [pid 796] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 796] setpgid(0, 0) = 0 [pid 796] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 796] write(3, "1000", 4) = 4 [pid 796] close(3) = 0 [pid 796] symlink("/dev/binderfs", "./binderfs") = 0 [pid 796] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 796] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 796] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 796] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[797], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 797 [pid 796] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 796] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 796] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 796] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 796] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[798], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 798 [pid 796] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 796] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 798 attached [pid 798] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 798] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 798] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 796] <... futex resumed>) = 0 [pid 796] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 796] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 798] <... futex resumed>) = 1 [pid 798] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 798] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 796] <... futex resumed>) = 0 [pid 796] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 796] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 798] <... futex resumed>) = 1 [pid 798] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 798] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 796] <... futex resumed>) = 0 [pid 796] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 796] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 798] <... futex resumed>) = 1 [pid 798] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 798] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 796] <... futex resumed>) = 0 [pid 798] <... futex resumed>) = 1 [pid 798] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 797 attached [pid 797] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 797] memfd_create("syzkaller", 0) = 5 [pid 797] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 785] <... close resumed>) = 0 [pid 785] mkdir("./file1", 0777 [pid 797] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 785] <... mkdir resumed>) = 0 [ 29.893595][ T780] EXT4-fs (loop1): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 29.916273][ T787] ext4 filesystem being mounted at /root/syzkaller.d28Auw/19/file1 supports timestamps until 2038 (0x7fffffff) [ 29.956793][ T785] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [pid 785] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 797] <... write resumed>) = 262144 [pid 797] munmap(0x7f35d66dd000, 262144) = 0 [pid 797] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 6 [pid 797] ioctl(6, LOOP_SET_FD, 5 [pid 787] <... mount resumed>) = 0 [pid 787] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 6 [pid 787] chdir("./file1") = 0 [pid 787] ioctl(4, LOOP_CLR_FD) = 0 [pid 787] close(4 [pid 797] <... ioctl resumed>) = 0 [pid 797] close(5) = 0 [pid 797] mkdir("./file1", 0777) = 0 [ 29.956793][ T785] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 29.956793][ T785] [ 29.976056][ T777] EXT4-fs (loop3): group descriptors corrupted! [ 29.982974][ T797] loop2: detected capacity change from 0 to 512 [ 29.999913][ T797] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 29.999913][ T797] Contact linux-ext4@vger.kernel.org if you think we should keep it. [pid 797] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 787] <... close resumed>) = 0 [pid 787] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 787] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 777] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 777] ioctl(5, LOOP_CLR_FD) = 0 [pid 777] close(5) = 0 [pid 777] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 777] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 773] exit_group(0 [pid 782] <... futex resumed>) = ? [pid 773] <... exit_group resumed>) = ? [pid 782] +++ exited with 0 +++ [pid 777] <... futex resumed>) = ? [pid 775] <... mount resumed>) = 0 [pid 775] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 775] chdir("./file1") = 0 [pid 775] ioctl(6, LOOP_CLR_FD) = 0 [pid 775] close(6) = 0 [pid 775] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 775] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 772] exit_group(0 [pid 778] <... futex resumed>) = ? [pid 772] <... exit_group resumed>) = ? [pid 778] +++ exited with 0 +++ [pid 775] <... futex resumed>) = ? [pid 775] +++ exited with 0 +++ [pid 772] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=772, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 300] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 300] umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 300] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 300] umount2("./17/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./17/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] unlink("./17/bus") = 0 [pid 300] umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] unlink("./17/binderfs") = 0 [ 29.999913][ T797] [ 30.031768][ T775] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/17/file1 supports timestamps until 2038 (0x7fffffff) [ 30.059122][ T785] EXT4-fs (loop4): 1 orphan inode deleted [pid 300] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 777] +++ exited with 0 +++ [pid 773] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=773, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 298] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 780] <... mount resumed>) = ? [pid 298] <... umount2 resumed>) = 0 [pid 298] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./19/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] unlink("./19/bus" [pid 780] +++ exited with 0 +++ [pid 779] +++ exited with 0 +++ [pid 785] <... mount resumed>) = 0 [pid 785] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 298] <... unlink resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=779, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 785] <... openat resumed>) = 5 [pid 785] chdir("./file1") = 0 [pid 788] <... write resumed>) = 16777216 [pid 788] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 788] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 785] ioctl(6, LOOP_CLR_FD) = 0 [pid 785] close(6) = 0 [pid 785] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 785] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 30.064683][ T785] EXT4-fs (loop4): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 30.079052][ T780] ext4 filesystem being mounted at /root/syzkaller.5s3MMz/18/file1 supports timestamps until 2038 (0x7fffffff) [ 30.099890][ T785] ext4 filesystem being mounted at /root/syzkaller.RJEgPO/21/file1 supports timestamps until 2038 (0x7fffffff) [pid 298] unlink("./19/binderfs") = 0 [pid 298] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./19/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./19/file1") = 0 [pid 296] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 784] exit_group(0 [pid 783] exit_group(0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 789] <... futex resumed>) = ? [pid 787] <... futex resumed>) = ? [pid 786] <... futex resumed>) = ? [pid 784] <... exit_group resumed>) = ? [pid 783] <... exit_group resumed>) = ? [pid 296] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 789] +++ exited with 0 +++ [pid 787] +++ exited with 0 +++ [pid 786] +++ exited with 0 +++ [pid 296] <... openat resumed>) = 3 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 785] <... futex resumed>) = ? [pid 785] +++ exited with 0 +++ [pid 783] +++ exited with 0 +++ [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./19") = 0 [pid 298] mkdir("./20", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 803 ./strace-static-x86_64: Process 803 attached [pid 803] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 803] chdir("./20") = 0 [pid 803] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 803] setpgid(0, 0) = 0 [pid 300] <... umount2 resumed>) = 0 [pid 300] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./17/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] umount2("./17/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 300] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] close(4) = 0 [pid 300] rmdir("./17/file1") = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] close(3) = 0 [pid 300] rmdir("./17") = 0 [pid 300] mkdir("./18", 0777) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 300] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 300] close(3) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 804 [pid 803] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 803] write(3, "1000", 4) = 4 [pid 803] close(3) = 0 [pid 803] symlink("/dev/binderfs", "./binderfs") = 0 [pid 803] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 803] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 296] <... umount2 resumed>) = 0 [pid 296] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 788] <... futex resumed>) = ? [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./18/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] unlink("./18/bus") = 0 [pid 296] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./18/binderfs") = 0 [pid 296] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 788] +++ exited with 0 +++ [pid 784] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=783, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 803] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 803] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[805], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 805 [pid 803] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 803] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 803] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 803] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 803] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[806], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 806 [pid 803] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 803] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 804 attached [pid 804] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 804] chdir("./18") = 0 [pid 804] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 804] setpgid(0, 0) = 0 [pid 804] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 804] write(3, "1000", 4) = 4 [pid 804] close(3) = 0 [pid 804] symlink("/dev/binderfs", "./binderfs") = 0 [pid 804] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 804] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 296] <... umount2 resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=784, si_uid=0, si_status=0, si_utime=0, si_stime=24} --- [pid 296] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./18/file1", ./strace-static-x86_64: Process 806 attached ./strace-static-x86_64: Process 805 attached [pid 804] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 797] <... mount resumed>) = 0 [pid 299] <... restart_syscall resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... openat resumed>) = 3 [pid 797] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 299] <... openat resumed>) = 3 [pid 295] fstat(3, [pid 797] <... openat resumed>) = 5 [pid 299] fstat(3, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 797] chdir("./file1" [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, [pid 806] set_robust_list(0x7f35deafd9e0, 24 [pid 805] set_robust_list(0x7f35deb1e9e0, 24 [pid 804] <... mprotect resumed>) = 0 [pid 797] <... chdir resumed>) = 0 [pid 299] getdents64(3, [pid 296] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 805] <... set_robust_list resumed>) = 0 [pid 299] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 806] <... set_robust_list resumed>) = 0 [pid 805] memfd_create("syzkaller", 0 [pid 804] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 797] ioctl(6, LOOP_CLR_FD [pid 299] <... umount2 resumed>) = 0 [pid 296] <... openat resumed>) = 4 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 807 attached [pid 806] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 805] <... memfd_create resumed>) = 3 [pid 797] <... ioctl resumed>) = 0 [pid 299] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] lstat("./19/bus", [pid 807] set_robust_list(0x7f35deb1e9e0, 24 [pid 806] <... open resumed>) = 4 [pid 804] <... clone resumed>, parent_tid=[807], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 807 [pid 797] close(6 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=16777216, ...}) = 0 [pid 807] <... set_robust_list resumed>) = 0 [pid 806] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 804] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 797] <... close resumed>) = 0 [pid 299] lstat("./21/bus", [pid 295] unlink("./19/bus" [pid 807] memfd_create("syzkaller", 0 [pid 806] <... futex resumed>) = 1 [pid 805] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 804] <... futex resumed>) = 0 [pid 803] <... futex resumed>) = 0 [pid 797] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] fstat(4, [pid 807] <... memfd_create resumed>) = 3 [pid 806] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 805] <... mmap resumed>) = 0x7f35d66dd000 [pid 804] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 803] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 797] <... futex resumed>) = 0 [pid 796] exit_group(0 [pid 299] unlink("./21/bus" [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 807] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 806] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 805] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 804] <... futex resumed>) = 0 [pid 803] <... futex resumed>) = 0 [pid 798] <... futex resumed>) = ? [pid 796] <... exit_group resumed>) = ? [pid 299] <... unlink resumed>) = 0 [pid 296] getdents64(4, [pid 807] <... mmap resumed>) = 0x7f35d66fe000 [pid 806] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 805] <... write resumed>) = 262144 [pid 804] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 803] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 798] +++ exited with 0 +++ [pid 797] +++ exited with 0 +++ [pid 796] +++ exited with 0 +++ [pid 299] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 807] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 806] <... mount resumed>) = 0 [pid 804] <... mmap resumed>) = 0x7f35d66dd000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] getdents64(4, [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=796, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 807] <... write resumed>) = 262144 [pid 806] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 805] munmap(0x7f35d66dd000, 262144 [pid 804] mprotect(0x7f35d66de000, 131072, PROT_READ|PROT_WRITE [pid 299] lstat("./21/binderfs", [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 296] close(4 [pid 807] munmap(0x7f35d66fe000, 262144 [pid 806] <... futex resumed>) = 1 [pid 805] <... munmap resumed>) = 0 [pid 804] <... mprotect resumed>) = 0 [pid 803] <... futex resumed>) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 807] <... munmap resumed>) = 0 [pid 806] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 805] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 804] clone(child_stack=0x7f35d66fd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 803] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] unlink("./21/binderfs" [pid 296] rmdir("./18/file1" [pid 807] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 806] <... open resumed>) = 5 [pid 805] <... openat resumed>) = 6 [pid 803] <... futex resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [ 30.115186][ T797] EXT4-fs (loop2): 1 orphan inode deleted [ 30.120871][ T797] EXT4-fs (loop2): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 30.145374][ T797] ext4 filesystem being mounted at /root/syzkaller.7ngmbG/20/file1 supports timestamps until 2038 (0x7fffffff) [pid 807] <... openat resumed>) = 4 [pid 806] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 805] ioctl(6, LOOP_SET_FD, 3 [pid 804] <... clone resumed>, parent_tid=[808], tls=0x7f35d66fd700, child_tidptr=0x7f35d66fd9d0) = 808 [pid 803] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(3, [pid 807] ioctl(4, LOOP_SET_FD, 3 [pid 806] <... futex resumed>) = 0 [pid 804] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 803] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 803] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] close(3 [pid 803] <... futex resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 803] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] fstat(3, [pid 296] rmdir("./18" [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 297] getdents64(3, [pid 296] mkdir("./19", 0777 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] <... mkdir resumed>) = 0 [pid 297] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 808 attached [pid 808] set_robust_list(0x7f35d66fd9e0, 24) = 0 [pid 808] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 806] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 804] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 297] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./20/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] unlink("./20/bus") = 0 [pid 297] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./20/binderfs") = 0 [pid 297] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 808] <... open resumed>) = 5 [pid 808] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 808] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 805] <... ioctl resumed>) = 0 [pid 805] close(3) = 0 [pid 805] mkdir("./file1", 0777) = 0 [pid 805] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 807] <... ioctl resumed>) = 0 [pid 807] close(3) = 0 [pid 807] mkdir("./file1", 0777) = 0 [pid 807] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 804] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... unlink resumed>) = 0 [ 30.196589][ T805] loop3: detected capacity change from 0 to 512 [ 30.205115][ T807] loop5: detected capacity change from 0 to 512 [ 30.212960][ T806] blk_update_request: I/O error, dev loop3, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 30.222770][ T807] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 30.222770][ T807] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 30.222770][ T807] [pid 804] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 804] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 804] <... futex resumed>) = 1 [pid 295] lstat("./19/binderfs", [pid 804] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./19/binderfs") = 0 [pid 295] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 808] <... futex resumed>) = 0 [pid 808] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 806] <... write resumed>) = -1 EIO (Input/output error) [pid 806] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 806] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 808] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 804] <... futex resumed>) = 0 [pid 808] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 804] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 808] <... open resumed>) = 3 [pid 804] <... futex resumed>) = 0 [pid 808] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 804] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 808] <... futex resumed>) = 0 [pid 804] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 808] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 804] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 804] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 808] <... write resumed>) = 262144 [pid 808] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 804] <... futex resumed>) = 0 [pid 808] <... futex resumed>) = 1 [pid 808] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 803] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 299] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 807] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 807] ioctl(4, LOOP_CLR_FD) = 0 [pid 807] close(4) = 0 [pid 807] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 804] exit_group(0 [pid 808] <... futex resumed>) = ? [pid 804] <... exit_group resumed>) = ? [pid 808] +++ exited with 0 +++ [ 30.231230][ T806] Buffer I/O error on dev loop3, logical block 0, lost async page write [ 30.253355][ T805] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 30.253355][ T805] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 30.253355][ T805] [ 30.259981][ T807] EXT4-fs warning (device loop5): read_mmp_block:115: Error -117 while reading MMP block 8 [ 30.281554][ T805] EXT4-fs (loop3): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [pid 299] lstat("./21/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... ioctl resumed>) = 0 [pid 299] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./21/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 299] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./21/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./21" [pid 296] close(3 [pid 299] <... rmdir resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] mkdir("./22", 0777) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 809 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 810 ./strace-static-x86_64: Process 809 attached [pid 809] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 809] chdir("./19") = 0 [pid 809] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 809] setpgid(0, 0) = 0 [pid 809] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 809] write(3, "1000", 4) = 4 [pid 809] close(3) = 0 [pid 809] symlink("/dev/binderfs", "./binderfs") = 0 [pid 809] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 809] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 809] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 809] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[811], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 811 [pid 809] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 809] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 809] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 297] <... umount2 resumed>) = 0 [pid 809] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 809] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 809] <... clone resumed>, parent_tid=[812], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 812 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 809] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] lstat("./20/file1", ./strace-static-x86_64: Process 810 attached {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 810] set_robust_list(0x555556c9c5e0, 24 [pid 809] <... futex resumed>) = 0 [pid 809] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 812 attached ./strace-static-x86_64: Process 811 attached [pid 810] <... set_robust_list resumed>) = 0 [pid 805] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 297] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 812] set_robust_list(0x7f35deafd9e0, 24 [pid 810] chdir("./22" [pid 805] ioctl(6, LOOP_CLR_FD [pid 811] set_robust_list(0x7f35deb1e9e0, 24 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 812] <... set_robust_list resumed>) = 0 [pid 812] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 805] <... ioctl resumed>) = 0 [pid 811] <... set_robust_list resumed>) = 0 [pid 810] <... chdir resumed>) = 0 [pid 805] close(6 [pid 297] openat(AT_FDCWD, "./20/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 812] <... open resumed>) = 3 [pid 805] <... close resumed>) = 0 [pid 297] <... openat resumed>) = 4 [pid 805] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 810] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 803] exit_group(0 [pid 812] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 810] <... prctl resumed>) = 0 [pid 805] <... futex resumed>) = 0 [pid 297] fstat(4, [pid 806] <... futex resumed>) = ? [pid 803] <... exit_group resumed>) = ? [pid 812] <... futex resumed>) = 1 [pid 810] setpgid(0, 0 [pid 811] memfd_create("syzkaller", 0 [pid 806] +++ exited with 0 +++ [pid 809] <... futex resumed>) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 812] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 810] <... setpgid resumed>) = 0 [pid 811] <... memfd_create resumed>) = 4 [pid 811] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 297] getdents64(4, [pid 810] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 810] <... openat resumed>) = 3 [pid 297] getdents64(4, [pid 810] write(3, "1000", 4) = 4 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 809] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 810] close(3 [pid 297] close(4) = 0 [pid 812] <... futex resumed>) = 0 [pid 810] <... close resumed>) = 0 [pid 809] <... futex resumed>) = 1 [pid 812] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 297] rmdir("./20/file1") = 0 [pid 810] symlink("/dev/binderfs", "./binderfs" [pid 812] <... mount resumed>) = 0 [pid 810] <... symlink resumed>) = 0 [pid 812] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] getdents64(3, [pid 812] <... futex resumed>) = 0 [pid 810] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 809] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 812] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 810] <... futex resumed>) = 0 [pid 810] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 809] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] close(3 [pid 810] <... mmap resumed>) = 0x7f35deafe000 [pid 810] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 297] <... close resumed>) = 0 [pid 810] <... mprotect resumed>) = 0 [pid 810] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] rmdir("./20") = 0 [pid 810] <... clone resumed>, parent_tid=[813], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 813 [pid 297] mkdir("./21", 0777 [pid 810] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 810] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 810] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 297] <... openat resumed>) = 3 [pid 810] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 810] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 811] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 810] <... clone resumed>, parent_tid=[814], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 814 [pid 297] <... close resumed>) = 0 [pid 810] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 810] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 809] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 815 ./strace-static-x86_64: Process 815 attached [pid 812] <... futex resumed>) = 0 [pid 809] <... futex resumed>) = 1 [pid 812] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 809] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 815] set_robust_list(0x555556c9c5e0, 24 [pid 812] <... open resumed>) = 5 [pid 815] <... set_robust_list resumed>) = 0 [pid 812] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 809] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 815] chdir("./21" [pid 812] <... futex resumed>) = 0 [pid 809] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 812] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 815] <... chdir resumed>) = 0 [pid 809] <... futex resumed>) = 0 [pid 812] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 815] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 812] <... futex resumed>) = 0 [pid 809] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 815] <... prctl resumed>) = 0 [pid 812] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 809] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 815] setpgid(0, 0) = 0 [pid 811] <... write resumed>) = 262144 [pid 811] munmap(0x7f35d66dd000, 262144 [pid 815] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 811] <... munmap resumed>) = 0 [pid 811] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 6 [pid 811] ioctl(6, LOOP_SET_FD, 4 [pid 815] <... openat resumed>) = 3 [pid 815] write(3, "1000", 4) = 4 [pid 815] close(3./strace-static-x86_64: Process 814 attached ./strace-static-x86_64: Process 813 attached ) = 0 [pid 811] <... ioctl resumed>) = 0 [pid 815] symlink("/dev/binderfs", "./binderfs" [pid 814] set_robust_list(0x7f35deafd9e0, 24 [pid 813] set_robust_list(0x7f35deb1e9e0, 24 [pid 815] <... symlink resumed>) = 0 [pid 814] <... set_robust_list resumed>) = 0 [pid 813] <... set_robust_list resumed>) = 0 [pid 811] close(4 [pid 295] <... umount2 resumed>) = 0 [pid 295] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./19/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] close(4 [pid 813] memfd_create("syzkaller", 0 [pid 815] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 814] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 295] <... close resumed>) = 0 [pid 295] rmdir("./19/file1" [pid 815] <... futex resumed>) = 0 [pid 814] <... open resumed>) = 3 [pid 813] <... memfd_create resumed>) = 4 [pid 811] <... close resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 815] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 814] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 813] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 815] <... mmap resumed>) = 0x7f35deafe000 [pid 814] <... futex resumed>) = 1 [pid 813] <... mmap resumed>) = 0x7f35d66dd000 [pid 810] <... futex resumed>) = 0 [pid 815] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 814] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 813] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 810] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] getdents64(3, [pid 815] <... mprotect resumed>) = 0 [pid 814] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 811] mkdir("./file1", 0777 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 815] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 814] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 813] <... write resumed>) = 262144 [pid 810] <... futex resumed>) = 0 [pid 807] +++ exited with 0 +++ [pid 805] +++ exited with 0 +++ [pid 804] +++ exited with 0 +++ [pid 803] +++ exited with 0 +++ [pid 814] <... mount resumed>) = 0 [pid 813] munmap(0x7f35d66dd000, 262144 [pid 810] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 815] <... clone resumed>, parent_tid=[816], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 816 [pid 814] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 813] <... munmap resumed>) = 0 [pid 810] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=804, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=803, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 815] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 814] <... futex resumed>) = 0 [pid 813] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 810] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 815] <... futex resumed>) = 0 [pid 814] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 813] <... openat resumed>) = 5 [pid 810] <... futex resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 815] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 814] <... open resumed>) = 6 [pid 813] ioctl(5, LOOP_SET_FD, 4 [pid 810] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 816 attached [pid 815] <... futex resumed>) = 0 [pid 814] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 811] <... mkdir resumed>) = 0 [pid 295] close(3 [pid 816] set_robust_list(0x7f35deb1e9e0, 24 [pid 815] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 814] <... futex resumed>) = 0 [pid 813] <... ioctl resumed>) = 0 [ 30.292276][ T805] EXT4-fs (loop3): group descriptors corrupted! [ 30.314082][ T811] loop1: detected capacity change from 0 to 512 [ 30.330480][ T813] loop4: detected capacity change from 0 to 512 [ 30.338776][ T811] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [pid 811] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 810] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 3 [pid 295] <... close resumed>) = 0 [pid 816] <... set_robust_list resumed>) = 0 [pid 815] <... mmap resumed>) = 0x7f35deadd000 [pid 814] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 813] close(4 [pid 810] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] fstat(3, [pid 298] fstat(3, [pid 815] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 814] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 813] <... close resumed>) = 0 [pid 810] <... futex resumed>) = 0 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 815] <... mprotect resumed>) = 0 [pid 814] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 813] mkdir("./file1", 0777 [pid 810] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] getdents64(3, [pid 298] getdents64(3, [pid 815] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 813] <... mkdir resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 813] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 300] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 815] <... clone resumed>, parent_tid=[817], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 817 [pid 300] <... umount2 resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 815] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./18/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] rmdir("./19" [pid 815] <... futex resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 815] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] lstat("./18/bus", [pid 298] lstat("./20/bus", [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] unlink("./18/bus" [pid 298] unlink("./20/bus" [pid 300] <... unlink resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 300] umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./18/binderfs", [pid 298] lstat("./20/binderfs", [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] unlink("./18/binderfs" [pid 298] unlink("./20/binderfs" [pid 300] <... unlink resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 300] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./18/file1", [pid 298] lstat("./20/file1", [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] umount2("./18/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... rmdir resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] openat(AT_FDCWD, "./20/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] <... openat resumed>) = 4 [pid 298] <... openat resumed>) = 4 [pid 300] fstat(4, [pid 298] fstat(4, [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(4, [pid 298] getdents64(4, ./strace-static-x86_64: Process 817 attached [pid 816] memfd_create("syzkaller", 0 [pid 814] <... write resumed>) = 262144 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] mkdir("./20", 0777 [pid 814] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] getdents64(4, [pid 298] getdents64(4, [pid 814] <... futex resumed>) = 1 [pid 810] <... futex resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 814] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] close(4 [pid 298] close(4 [pid 300] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 300] rmdir("./18/file1" [pid 298] rmdir("./20/file1" [pid 817] set_robust_list(0x7f35deafd9e0, 24 [pid 816] <... memfd_create resumed>) = 3 [pid 300] <... rmdir resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 300] getdents64(3, [pid 298] getdents64(3, [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 817] <... set_robust_list resumed>) = 0 [pid 300] close(3 [pid 298] close(3 [pid 295] <... mkdir resumed>) = 0 [pid 817] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 816] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 300] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 300] rmdir("./18" [pid 298] rmdir("./20" [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 817] <... open resumed>) = 4 [pid 816] <... mmap resumed>) = 0x7f35d66dd000 [pid 300] <... rmdir resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 817] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] mkdir("./19", 0777 [pid 298] mkdir("./21", 0777 [pid 295] <... openat resumed>) = 3 [pid 300] <... mkdir resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 300] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 3 [pid 300] ioctl(3, LOOP_CLR_FD [pid 298] ioctl(3, LOOP_CLR_FD [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] close(3 [pid 298] close(3 [pid 817] <... futex resumed>) = 1 [pid 816] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 815] <... futex resumed>) = 0 [pid 813] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 817] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 816] <... write resumed>) = 262144 [pid 815] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 813] ioctl(5, LOOP_CLR_FD [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 817] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 816] munmap(0x7f35d66dd000, 262144 [pid 815] <... futex resumed>) = 0 [pid 813] <... ioctl resumed>) = 0 [pid 295] close(3 [pid 817] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 816] <... munmap resumed>) = 0 [pid 815] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 813] close(5 [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 819 [pid 295] <... close resumed>) = 0 [pid 817] <... mount resumed>) = 0 [pid 816] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 813] <... close resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 817] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 816] <... openat resumed>) = 5 [pid 813] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 820 [pid 817] <... futex resumed>) = 1 [pid 816] ioctl(5, LOOP_SET_FD, 3 [ 30.338776][ T811] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 30.338776][ T811] [ 30.369140][ T813] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [pid 815] <... futex resumed>) = 0 [pid 813] <... futex resumed>) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 822 ./strace-static-x86_64: Process 822 attached ./strace-static-x86_64: Process 820 attached ./strace-static-x86_64: Process 819 attached [pid 817] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 816] <... ioctl resumed>) = 0 [pid 815] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 810] exit_group(0 [pid 822] set_robust_list(0x555556c9c5e0, 24 [pid 820] set_robust_list(0x555556c9c5e0, 24 [pid 819] set_robust_list(0x555556c9c5e0, 24 [pid 815] <... futex resumed>) = 0 [pid 814] <... futex resumed>) = ? [pid 810] <... exit_group resumed>) = ? [pid 822] <... set_robust_list resumed>) = 0 [pid 820] <... set_robust_list resumed>) = 0 [pid 819] <... set_robust_list resumed>) = 0 [pid 817] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 815] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 814] +++ exited with 0 +++ [pid 822] chdir("./20" [pid 820] chdir("./21" [pid 819] chdir("./19" [pid 822] <... chdir resumed>) = 0 [pid 820] <... chdir resumed>) = 0 [pid 819] <... chdir resumed>) = 0 [pid 822] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 820] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 819] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 822] <... prctl resumed>) = 0 [pid 820] <... prctl resumed>) = 0 [pid 819] <... prctl resumed>) = 0 [pid 822] setpgid(0, 0 [pid 820] setpgid(0, 0 [pid 819] setpgid(0, 0 [pid 822] <... setpgid resumed>) = 0 [pid 820] <... setpgid resumed>) = 0 [pid 819] <... setpgid resumed>) = 0 [pid 822] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 820] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 819] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 822] <... openat resumed>) = 3 [pid 820] <... openat resumed>) = 3 [pid 819] <... openat resumed>) = 3 [pid 822] write(3, "1000", 4 [pid 820] write(3, "1000", 4 [pid 819] write(3, "1000", 4 [pid 822] <... write resumed>) = 4 [pid 820] <... write resumed>) = 4 [pid 819] <... write resumed>) = 4 [pid 822] close(3 [pid 820] close(3 [pid 819] close(3 [pid 822] <... close resumed>) = 0 [pid 820] <... close resumed>) = 0 [pid 819] <... close resumed>) = 0 [pid 822] symlink("/dev/binderfs", "./binderfs" [pid 820] symlink("/dev/binderfs", "./binderfs" [pid 819] symlink("/dev/binderfs", "./binderfs" [pid 822] <... symlink resumed>) = 0 [pid 820] <... symlink resumed>) = 0 [pid 819] <... symlink resumed>) = 0 [pid 822] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 819] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 822] <... futex resumed>) = 0 [pid 820] <... futex resumed>) = 0 [pid 819] <... futex resumed>) = 0 [pid 822] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 820] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 819] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 822] <... mmap resumed>) = 0x7f35deafe000 [pid 820] <... mmap resumed>) = 0x7f35deafe000 [pid 819] <... mmap resumed>) = 0x7f35deafe000 [pid 822] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 820] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 819] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 822] <... mprotect resumed>) = 0 [pid 820] <... mprotect resumed>) = 0 [pid 819] <... mprotect resumed>) = 0 [pid 822] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 820] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 819] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 817] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 822] <... clone resumed>, parent_tid=[824], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 824 [pid 820] <... clone resumed>, parent_tid=[825], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 825 [pid 819] <... clone resumed>, parent_tid=[826], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 826 [pid 822] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 819] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 817] <... open resumed>) = 6 [pid 822] <... futex resumed>) = 0 [pid 820] <... futex resumed>) = 0 [pid 819] <... futex resumed>) = 0 [pid 822] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 819] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 822] <... futex resumed>) = 0 [pid 820] <... futex resumed>) = 0 [pid 819] <... futex resumed>) = 0 [pid 822] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 820] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 819] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 822] <... mmap resumed>) = 0x7f35deadd000 [pid 820] <... mmap resumed>) = 0x7f35deadd000 [pid 819] <... mmap resumed>) = 0x7f35deadd000 [pid 822] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 820] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 819] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 822] <... mprotect resumed>) = 0 [pid 820] <... mprotect resumed>) = 0 [pid 819] <... mprotect resumed>) = 0 [pid 822] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 820] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 819] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 817] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 816] close(3 [pid 815] <... futex resumed>) = 0 [pid 822] <... clone resumed>, parent_tid=[827], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 827 [pid 820] <... clone resumed>, parent_tid=[828], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 828 [pid 819] <... clone resumed>, parent_tid=[829], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 829 [pid 815] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 822] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 819] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 815] <... futex resumed>) = 0 [pid 822] <... futex resumed>) = 0 [pid 820] <... futex resumed>) = 0 [pid 819] <... futex resumed>) = 0 [pid 815] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 822] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 820] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 819] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 828 attached [pid 828] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 828] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 828] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] <... futex resumed>) = 0 [pid 820] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 820] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 828] <... futex resumed>) = 1 [pid 828] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 828] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] <... futex resumed>) = 0 [pid 820] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 820] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 828] <... futex resumed>) = 1 [pid 828] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 ./strace-static-x86_64: Process 825 attached [pid 828] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 825] set_robust_list(0x7f35deb1e9e0, 24 [pid 820] <... futex resumed>) = 0 [pid 820] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 820] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 828] <... futex resumed>) = 1 [pid 825] <... set_robust_list resumed>) = 0 [pid 828] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 825] memfd_create("syzkaller", 0 [pid 828] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 828] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 820] <... futex resumed>) = 0 [pid 828] <... futex resumed>) = 1 [pid 828] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 825] <... memfd_create resumed>) = 5 ./strace-static-x86_64: Process 827 attached [pid 827] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 827] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 825] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 827] <... open resumed>) = 3 [pid 825] <... mmap resumed>) = 0x7f35d66dd000 [pid 827] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 822] <... futex resumed>) = 0 [pid 827] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 822] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 827] <... mount resumed>) = 0 [pid 822] <... futex resumed>) = 0 [pid 827] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 822] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 827] <... futex resumed>) = 0 [pid 822] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 827] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 822] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 827] <... open resumed>) = 4 [pid 822] <... futex resumed>) = 0 [pid 827] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 822] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 827] <... futex resumed>) = 0 [pid 822] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 827] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 822] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 827] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 822] <... futex resumed>) = 0 [pid 827] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 822] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 827] <... futex resumed>) = 0 [pid 822] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 827] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 825] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 825] munmap(0x7f35d66dd000, 262144) = 0 [pid 825] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 6 [pid 825] ioctl(6, LOOP_SET_FD, 5./strace-static-x86_64: Process 829 attached [pid 817] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 816] <... close resumed>) = 0 [pid 825] <... ioctl resumed>) = 0 [pid 825] close(5) = 0 [pid 825] mkdir("./file1", 0777) = 0 [ 30.392327][ T816] loop2: detected capacity change from 0 to 512 [ 30.400749][ T811] EXT4-fs (loop1): 1 orphan inode deleted [ 30.408879][ T811] EXT4-fs (loop1): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 30.420128][ T825] loop3: detected capacity change from 0 to 512 [pid 825] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"..../strace-static-x86_64: Process 826 attached ./strace-static-x86_64: Process 824 attached [pid 829] set_robust_list(0x7f35deafd9e0, 24 [pid 817] <... write resumed>) = 262144 [pid 816] mkdir("./file1", 0777 [pid 819] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 815] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 819] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 819] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deabc000 [pid 819] mprotect(0x7f35deabd000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 819] clone(child_stack=0x7f35deadc3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[830], tls=0x7f35deadc700, child_tidptr=0x7f35deadc9d0) = 830 [pid 819] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 819] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 830 attached [pid 830] set_robust_list(0x7f35deadc9e0, 24) = 0 [pid 830] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = -1 ENOENT (No such file or directory) [pid 830] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 819] <... futex resumed>) = 0 [pid 819] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 819] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 830] <... futex resumed>) = 1 [pid 830] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = -1 ENOENT (No such file or directory) [pid 830] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 819] <... futex resumed>) = 0 [pid 819] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 819] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 830] <... futex resumed>) = 1 [pid 830] write(-1, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 EBADF (Bad file descriptor) [pid 830] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 819] <... futex resumed>) = 0 [pid 830] <... futex resumed>) = 1 [pid 830] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 829] <... set_robust_list resumed>) = 0 [pid 826] set_robust_list(0x7f35deb1e9e0, 24 [pid 824] set_robust_list(0x7f35deb1e9e0, 24 [pid 817] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 816] <... mkdir resumed>) = 0 [pid 829] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 826] <... set_robust_list resumed>) = 0 [pid 824] <... set_robust_list resumed>) = 0 [pid 817] <... futex resumed>) = 0 [pid 816] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 829] <... open resumed>) = 3 [pid 826] memfd_create("syzkaller", 0 [pid 824] memfd_create("syzkaller", 0 [pid 817] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 829] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 826] <... memfd_create resumed>) = 4 [pid 824] <... memfd_create resumed>) = 5 [pid 811] <... mount resumed>) = 0 [pid 811] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 4 [pid 811] chdir("./file1") = 0 [pid 811] ioctl(6, LOOP_CLR_FD) = 0 [pid 811] close(6) = 0 [pid 811] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 811] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 829] <... futex resumed>) = 0 [pid 829] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 826] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66bc000 [pid 826] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 826] munmap(0x7f35d66bc000, 262144) = 0 [pid 826] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 5 [pid 826] ioctl(5, LOOP_SET_FD, 4) = 0 [pid 824] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 816] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 809] exit_group(0 [pid 824] <... mmap resumed>) = 0x7f35d66dd000 [pid 809] <... exit_group resumed>) = ? [pid 812] <... futex resumed>) = ? [pid 812] +++ exited with 0 +++ [pid 826] close(4) = 0 [pid 826] mkdir("./file1", 0777) = 0 [pid 826] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [ 30.441215][ T825] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 30.441215][ T825] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 30.441215][ T825] [ 30.441378][ T811] ext4 filesystem being mounted at /root/syzkaller.5s3MMz/19/file1 supports timestamps until 2038 (0x7fffffff) [ 30.469436][ T816] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [ 30.476707][ T826] loop5: detected capacity change from 0 to 512 [ 30.485746][ T826] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [pid 824] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 816] ioctl(5, LOOP_CLR_FD [pid 811] <... futex resumed>) = ? [pid 824] munmap(0x7f35d66dd000, 262144) = 0 [pid 824] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6 [pid 824] ioctl(6, LOOP_SET_FD, 5 [pid 816] <... ioctl resumed>) = 0 [pid 811] +++ exited with 0 +++ [pid 809] +++ exited with 0 +++ [pid 816] close(5 [pid 824] <... ioctl resumed>) = 0 [pid 816] <... close resumed>) = 0 [pid 824] close(5 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=809, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 816] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 824] <... close resumed>) = 0 [pid 816] <... futex resumed>) = 0 [pid 824] mkdir("./file1", 0777 [pid 816] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 815] exit_group(0 [pid 824] <... mkdir resumed>) = 0 [pid 817] <... futex resumed>) = ? [pid 816] <... futex resumed>) = ? [pid 815] <... exit_group resumed>) = ? [pid 824] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 817] +++ exited with 0 +++ [pid 816] +++ exited with 0 +++ [pid 296] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [ 30.485746][ T826] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 30.485746][ T826] [ 30.487361][ T824] loop0: detected capacity change from 0 to 512 [ 30.513309][ T825] EXT4-fs (loop3): 1 orphan inode deleted [ 30.516180][ T824] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 30.516180][ T824] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 30.516180][ T824] [pid 296] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 813] +++ exited with 0 +++ [pid 810] +++ exited with 0 +++ [pid 296] <... umount2 resumed>) = 0 [pid 296] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./19/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] unlink("./19/bus") = 0 [pid 296] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./19/binderfs") = 0 [pid 296] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=810, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 299] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [ 30.519813][ T825] EXT4-fs (loop3): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 30.565660][ T825] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/21/file1 supports timestamps until 2038 (0x7fffffff) [ 30.569806][ T826] EXT4-fs (loop5): 1 orphan inode deleted [ 30.580216][ T824] EXT4-fs (loop0): 1 orphan inode deleted [pid 299] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 815] +++ exited with 0 +++ [pid 299] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./22/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] unlink("./22/bus") = 0 [pid 299] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./22/binderfs") = 0 [pid 299] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./22/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./22/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 299] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./22/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./22") = 0 [pid 299] mkdir("./23", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 837 [pid 825] <... mount resumed>) = 0 [pid 825] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 825] chdir("./file1") = 0 [pid 825] ioctl(6, LOOP_CLR_FD) = 0 [pid 825] close(6) = 0 [pid 825] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 825] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 820] exit_group(0 [pid 828] <... futex resumed>) = ? [pid 820] <... exit_group resumed>) = ? [pid 828] +++ exited with 0 +++ [pid 825] <... futex resumed>) = ? [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=815, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 297] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 825] +++ exited with 0 +++ [pid 820] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=820, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 298] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 298] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [ 30.583406][ T826] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 30.612221][ T824] EXT4-fs (loop0): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [pid 298] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 826] <... mount resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 297] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 837 attached [pid 298] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./21/bus", [pid 298] lstat("./21/bus", [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] unlink("./21/bus" [pid 298] unlink("./21/bus" [pid 297] <... unlink resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 297] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./21/binderfs", [pid 298] lstat("./21/binderfs", [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./21/binderfs" [pid 298] unlink("./21/binderfs" [pid 297] <... unlink resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 297] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./21/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./21/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./21/file1") = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./21") = 0 [pid 297] mkdir("./22", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 837] set_robust_list(0x555556c9c5e0, 24 [pid 826] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 824] <... mount resumed>) = 0 [pid 837] <... set_robust_list resumed>) = 0 [pid 826] <... openat resumed>) = 4 [pid 837] chdir("./23" [pid 826] chdir("./file1" [pid 824] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 837] <... chdir resumed>) = 0 [pid 826] <... chdir resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 837] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 826] ioctl(5, LOOP_CLR_FD [pid 824] <... openat resumed>) = 5 [pid 837] <... prctl resumed>) = 0 [pid 826] <... ioctl resumed>) = 0 [pid 837] setpgid(0, 0 [pid 826] close(5 [pid 824] chdir("./file1" [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 837] <... setpgid resumed>) = 0 [pid 826] <... close resumed>) = 0 [pid 837] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 826] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 824] <... chdir resumed>) = 0 [pid 837] <... openat resumed>) = 3 [pid 826] <... futex resumed>) = 0 [pid 837] write(3, "1000", 4 [pid 826] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 824] ioctl(6, LOOP_CLR_FD [pid 837] <... write resumed>) = 4 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 838 [pid 837] close(3 [pid 824] <... ioctl resumed>) = 0 [pid 837] <... close resumed>) = 0 [pid 837] symlink("/dev/binderfs", "./binderfs" [pid 824] close(6 [pid 837] <... symlink resumed>) = 0 [pid 837] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 824] <... close resumed>) = 0 [pid 819] exit_group(0 [pid 837] <... futex resumed>) = 0 [pid 837] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 824] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 837] <... mmap resumed>) = 0x7f35deafe000 [pid 819] <... exit_group resumed>) = ? [pid 830] <... futex resumed>) = 139869346062336 [pid 837] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 829] <... futex resumed>) = ? [pid 826] <... futex resumed>) = ? [pid 837] <... mprotect resumed>) = 0 [pid 830] +++ exited with 0 +++ [pid 829] +++ exited with 0 +++ [pid 837] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[839], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 839 [pid 837] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 837] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 837] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 837] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 826] +++ exited with 0 +++ [pid 819] +++ exited with 0 +++ [pid 837] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[840], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 840 [pid 822] exit_group(0 [pid 837] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 822] <... exit_group resumed>) = ? [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=819, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 827] <... futex resumed>) = ? [pid 837] <... futex resumed>) = 0 [pid 837] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 827] +++ exited with 0 +++ [pid 300] umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 300] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 824] <... futex resumed>) = ? [pid 300] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] umount2("./19/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./19/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] unlink("./19/bus"./strace-static-x86_64: Process 838 attached ) = 0 [pid 300] umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 824] +++ exited with 0 +++ [pid 822] +++ exited with 0 +++ [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=822, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 300] unlink("./19/binderfs" [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 838] set_robust_list(0x555556c9c5e0, 24 [pid 300] <... unlink resumed>) = 0 [pid 295] <... restart_syscall resumed>) = 0 [pid 300] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 838] <... set_robust_list resumed>) = 0 [pid 295] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW [pid 838] chdir("./22" [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 838] <... chdir resumed>) = 0 [pid 838] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 295] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, [pid 838] <... prctl resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 295] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 840 attached ./strace-static-x86_64: Process 839 attached ) = -1 EINVAL (Invalid argument) [pid 840] set_robust_list(0x7f35deafd9e0, 24 [pid 839] set_robust_list(0x7f35deb1e9e0, 24 [pid 838] setpgid(0, 0 [pid 295] lstat("./20/bus", [pid 840] <... set_robust_list resumed>) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 840] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 839] <... set_robust_list resumed>) = 0 [pid 838] <... setpgid resumed>) = 0 [pid 295] unlink("./20/bus" [pid 840] <... open resumed>) = 3 [pid 295] <... unlink resumed>) = 0 [pid 295] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 840] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] lstat("./20/binderfs", [pid 837] <... futex resumed>) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 837] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] unlink("./20/binderfs" [pid 837] <... futex resumed>) = 0 [pid 837] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... unlink resumed>) = 0 [pid 295] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 840] <... futex resumed>) = 1 [pid 840] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 296] <... umount2 resumed>) = 0 [pid 296] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./19/file1", [pid 840] <... mount resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 840] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 840] <... futex resumed>) = 1 [pid 837] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 840] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 837] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 840] <... open resumed>) = 4 [pid 837] <... futex resumed>) = 0 [pid 296] <... openat resumed>) = 4 [pid 840] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 837] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] fstat(4, [pid 840] <... futex resumed>) = 0 [pid 837] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 840] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 839] memfd_create("syzkaller", 0 [pid 838] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 837] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 840] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 837] <... futex resumed>) = 0 [pid 296] getdents64(4, [pid 840] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 837] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 840] <... futex resumed>) = 0 [pid 837] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 840] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] getdents64(4, [pid 839] <... memfd_create resumed>) = 5 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 839] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 296] close(4 [pid 838] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 838] write(3, "1000", 4 [pid 296] rmdir("./19/file1" [pid 838] <... write resumed>) = 4 [pid 839] <... mmap resumed>) = 0x7f35d66dd000 [pid 838] close(3 [pid 296] <... rmdir resumed>) = 0 [pid 838] <... close resumed>) = 0 [pid 296] getdents64(3, [pid 838] symlink("/dev/binderfs", "./binderfs" [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 838] <... symlink resumed>) = 0 [pid 296] close(3 [pid 838] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 838] <... futex resumed>) = 0 [pid 296] rmdir("./19" [pid 838] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... rmdir resumed>) = 0 [pid 839] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 838] <... mmap resumed>) = 0x7f35deafe000 [pid 296] mkdir("./20", 0777 [pid 838] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 296] <... mkdir resumed>) = 0 [pid 838] <... mprotect resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 839] <... write resumed>) = 262144 [pid 838] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] <... openat resumed>) = 3 [pid 296] ioctl(3, LOOP_CLR_FD [pid 838] <... clone resumed>, parent_tid=[841], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 841 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 838] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] close(3 [pid 838] <... futex resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 838] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 841 attached [pid 839] munmap(0x7f35d66dd000, 262144 [pid 838] <... futex resumed>) = 0 [pid 838] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 842 [pid 839] <... munmap resumed>) = 0 [pid 838] <... mmap resumed>) = 0x7f35deadd000 [pid 838] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 838] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 841] set_robust_list(0x7f35deb1e9e0, 24 [pid 839] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 838] <... clone resumed>, parent_tid=[843], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 843 ./strace-static-x86_64: Process 842 attached [pid 838] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 838] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 843 attached [pid 843] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 843] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 843] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 839] <... openat resumed>) = 6 [pid 841] <... set_robust_list resumed>) = 0 [pid 839] ioctl(6, LOOP_SET_FD, 5 [pid 838] <... futex resumed>) = 0 [pid 838] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 838] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 843] <... futex resumed>) = 1 [pid 843] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 843] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 838] <... futex resumed>) = 0 [pid 838] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 838] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 843] <... futex resumed>) = 1 [pid 843] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 843] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 838] <... futex resumed>) = 0 [pid 838] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 838] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 843] <... futex resumed>) = 1 [pid 843] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 843] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 838] <... futex resumed>) = 0 [pid 843] <... futex resumed>) = 1 [pid 843] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 842] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 842] chdir("./20") = 0 [pid 842] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 842] setpgid(0, 0) = 0 [pid 842] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 842] write(3, "1000", 4) = 4 [pid 842] close(3) = 0 [pid 842] symlink("/dev/binderfs", "./binderfs") = 0 [pid 842] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 842] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 842] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 842] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[844], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 844 [pid 842] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 842] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 842] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 842] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 842] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[845], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 845 [pid 842] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 842] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 844 attached [pid 844] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 844] memfd_create("syzkaller", 0) = 3 [pid 844] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 841] memfd_create("syzkaller", 0./strace-static-x86_64: Process 845 attached [pid 839] <... ioctl resumed>) = 0 [pid 841] <... memfd_create resumed>) = 5 [pid 839] close(5 [pid 845] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 841] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 839] <... close resumed>) = 0 [pid 841] <... mmap resumed>) = 0x7f35d66dd000 [pid 839] mkdir("./file1", 0777 [pid 845] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 844] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 844] munmap(0x7f35d66dd000, 262144) = 0 [pid 844] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 841] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 844] <... openat resumed>) = 4 [pid 844] ioctl(4, LOOP_SET_FD, 3 [pid 845] <... open resumed>) = 5 [pid 841] <... write resumed>) = 262144 [pid 839] <... mkdir resumed>) = 0 [pid 841] munmap(0x7f35d66dd000, 262144) = 0 [pid 841] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 6 [pid 841] ioctl(6, LOOP_SET_FD, 5 [ 30.638203][ T826] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/19/file1 supports timestamps until 2038 (0x7fffffff) [ 30.651249][ T824] ext4 filesystem being mounted at /root/syzkaller.d28Auw/20/file1 supports timestamps until 2038 (0x7fffffff) [ 30.686297][ T839] loop4: detected capacity change from 0 to 512 [pid 839] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 845] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 844] <... ioctl resumed>) = 0 [pid 841] <... ioctl resumed>) = 0 [pid 841] close(5) = 0 [pid 841] mkdir("./file1", 0777) = 0 [pid 841] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 845] <... futex resumed>) = 1 [pid 845] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 844] close(3) = 0 [pid 844] mkdir("./file1", 0777) = 0 [pid 844] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 842] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [ 30.695617][ T844] loop1: detected capacity change from 0 to 512 [ 30.698862][ T841] loop2: detected capacity change from 0 to 512 [ 30.702198][ T839] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 30.702198][ T839] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 30.702198][ T839] [ 30.712442][ T844] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 30.712442][ T844] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 30.712442][ T844] [pid 842] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 300] <... umount2 resumed>) = 0 [pid 298] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 842] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] lstat("./20/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] lstat("./21/file1", [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./19/file1", [pid 298] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./20/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] umount2("./19/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] openat(AT_FDCWD, "./21/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... openat resumed>) = 4 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... openat resumed>) = 4 [pid 295] fstat(4, [pid 300] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] fstat(4, [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... openat resumed>) = 4 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(4, [pid 300] fstat(4, [pid 298] getdents64(4, [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, [pid 300] getdents64(4, [pid 298] getdents64(4, [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] close(4 [pid 300] getdents64(4, [pid 298] close(4 [pid 295] <... close resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] <... close resumed>) = 0 [pid 295] rmdir("./20/file1" [pid 300] close(4 [pid 298] rmdir("./21/file1" [pid 295] <... rmdir resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 295] getdents64(3, [pid 300] rmdir("./19/file1" [pid 298] getdents64(3, [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] close(3 [pid 300] getdents64(3, [pid 298] close(3 [pid 295] <... close resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] <... close resumed>) = 0 [pid 295] rmdir("./20" [pid 300] close(3 [pid 298] rmdir("./21" [pid 295] <... rmdir resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 295] mkdir("./21", 0777 [pid 300] rmdir("./19" [pid 298] mkdir("./22", 0777 [pid 295] <... mkdir resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 300] mkdir("./20", 0777 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] <... openat resumed>) = 3 [pid 300] <... mkdir resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 295] ioctl(3, LOOP_CLR_FD [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] ioctl(3, LOOP_CLR_FD [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] <... openat resumed>) = 3 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] close(3 [pid 300] ioctl(3, LOOP_CLR_FD [pid 298] close(3 [pid 295] <... close resumed>) = 0 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... close resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] close(3 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] <... close resumed>) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 846 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 847 [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 848 [pid 845] <... futex resumed>) = 0 ./strace-static-x86_64: Process 848 attached [pid 848] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 848] chdir("./20") = 0 [pid 845] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 848] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 848] setpgid(0, 0) = 0 [pid 848] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 845] <... mount resumed>) = 0 [pid 845] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 848] write(3, "1000", 4) = 4 [pid 848] close(3) = 0 [pid 848] symlink("/dev/binderfs", "./binderfs" [pid 842] <... futex resumed>) = 0 [pid 842] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 845] <... futex resumed>) = 1 [pid 842] <... futex resumed>) = 0 [pid 842] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 848] <... symlink resumed>) = 0 [pid 848] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 848] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 848] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 848] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 845] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 3 [pid 848] <... clone resumed>, parent_tid=[850], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 850 [pid 845] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 848] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 846 attached [pid 848] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 848] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 846] set_robust_list(0x555556c9c5e0, 24 [pid 848] <... mmap resumed>) = 0x7f35deadd000 [pid 848] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 842] <... futex resumed>) = 0 [pid 845] <... futex resumed>) = 1 [pid 842] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 845] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 842] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 848] <... mprotect resumed>) = 0 [pid 848] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 846] <... set_robust_list resumed>) = 0 [pid 846] chdir("./21") = 0 [pid 846] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 846] setpgid(0, 0) = 0 [pid 848] <... clone resumed>, parent_tid=[851], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 851 [pid 846] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 848] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 848] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 846] <... openat resumed>) = 3 [pid 846] write(3, "1000", 4) = 4 [pid 846] close(3) = 0 [pid 846] symlink("/dev/binderfs", "./binderfs") = 0 [pid 846] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 846] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 846] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 846] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[852], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 852 [pid 846] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 846] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 846] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 846] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 845] <... write resumed>) = 262144 [pid 846] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[853], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 853 [pid 846] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 846] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 845] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 851 attached [pid 851] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 851] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 845] <... futex resumed>) = 1 [pid 842] <... futex resumed>) = 0 [pid 845] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 851] <... open resumed>) = 3 [pid 851] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 848] <... futex resumed>) = 0 [pid 848] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 848] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 851] <... futex resumed>) = 1 [pid 851] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 851] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 848] <... futex resumed>) = 0 [pid 848] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 848] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 851] <... futex resumed>) = 1 [pid 851] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 851] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 848] <... futex resumed>) = 0 [pid 848] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 848] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 851] <... futex resumed>) = 1 [pid 851] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 851] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 848] <... futex resumed>) = 0 [pid 851] <... futex resumed>) = 1 [pid 851] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 852 attached [pid 852] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 852] memfd_create("syzkaller", 0./strace-static-x86_64: Process 850 attached [pid 850] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 850] memfd_create("syzkaller", 0 [pid 852] <... memfd_create resumed>) = 3 [pid 850] <... memfd_create resumed>) = 5 [pid 850] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 852] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 850] <... mmap resumed>) = 0x7f35d66dd000 [pid 852] <... mmap resumed>) = 0x7f35d66dd000 [pid 850] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 852] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 850] <... write resumed>) = 262144 [pid 852] munmap(0x7f35d66dd000, 262144 [pid 850] munmap(0x7f35d66dd000, 262144) = 0 [pid 852] <... munmap resumed>) = 0 [pid 850] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 852] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 850] <... openat resumed>) = 6 [pid 850] ioctl(6, LOOP_SET_FD, 5./strace-static-x86_64: Process 853 attached ./strace-static-x86_64: Process 847 attached [ 30.745491][ T841] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 30.745491][ T841] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 30.745491][ T841] [ 30.779078][ T849] EXT4-fs warning (device loop1): kmmpd:170: kmmpd being stopped since MMP feature has been disabled. [ 30.785291][ T850] loop5: detected capacity change from 0 to 512 [pid 852] ioctl(4, LOOP_SET_FD, 3 [pid 853] set_robust_list(0x7f35deafd9e0, 24 [pid 847] set_robust_list(0x555556c9c5e0, 24 [pid 846] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 853] <... set_robust_list resumed>) = 0 [pid 847] <... set_robust_list resumed>) = 0 [pid 846] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 853] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 847] chdir("./22" [pid 846] <... futex resumed>) = 0 [pid 853] <... open resumed>) = 5 [pid 852] <... ioctl resumed>) = 0 [pid 850] <... ioctl resumed>) = 0 [pid 847] <... chdir resumed>) = 0 [pid 846] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 852] close(3 [pid 850] close(5 [pid 846] <... mmap resumed>) = 0x7f35d66fc000 [pid 852] <... close resumed>) = 0 [pid 850] <... close resumed>) = 0 [pid 846] mprotect(0x7f35d66fd000, 131072, PROT_READ|PROT_WRITE [pid 853] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 852] mkdir("./file1", 0777 [pid 850] mkdir("./file1", 0777 [pid 847] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 846] <... mprotect resumed>) = 0 [pid 853] <... futex resumed>) = 0 [pid 852] <... mkdir resumed>) = 0 [pid 850] <... mkdir resumed>) = 0 [pid 846] clone(child_stack=0x7f35d671c3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 852] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 850] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 846] <... clone resumed>, parent_tid=[859], tls=0x7f35d671c700, child_tidptr=0x7f35d671c9d0) = 859 [pid 846] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 846] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 844] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 844] ioctl(4, LOOP_CLR_FD) = 0 [ 30.796506][ T844] EXT4-fs error (device loop1): __ext4_get_inode_loc:4350: comm syz-executor252: Invalid inode table block 0 in block_group 0 [ 30.797317][ T852] loop0: detected capacity change from 0 to 512 [ 30.816270][ T844] EXT4-fs (loop1): get root inode failed [ 30.826375][ T844] EXT4-fs (loop1): mount failed [ 30.839841][ T850] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [pid 844] close(4 [pid 853] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 847] <... prctl resumed>) = 0 [pid 844] <... close resumed>) = 0 [pid 844] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 844] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 859 attached [pid 859] set_robust_list(0x7f35d671c9e0, 24) = 0 [pid 859] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 859] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 846] <... futex resumed>) = 0 [pid 846] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 846] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 859] <... futex resumed>) = 1 [pid 859] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 853] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 847] setpgid(0, 0 [pid 853] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 847] <... setpgid resumed>) = 0 [pid 842] exit_group(0 [pid 853] <... open resumed>) = 3 [pid 847] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 845] <... futex resumed>) = ? [pid 844] <... futex resumed>) = ? [pid 842] <... exit_group resumed>) = ? [pid 853] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 847] <... openat resumed>) = 3 [pid 845] +++ exited with 0 +++ [pid 853] <... futex resumed>) = 1 [pid 847] write(3, "1000", 4 [pid 853] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 847] <... write resumed>) = 4 [pid 847] close(3) = 0 [pid 847] symlink("/dev/binderfs", "./binderfs") = 0 [pid 847] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 847] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 847] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 847] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[861], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 861 [pid 847] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 847] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 847] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 847] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 847] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[862], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 862 [pid 847] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 30.839841][ T850] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 30.839841][ T850] [ 30.844701][ T852] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 30.844701][ T852] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 30.844701][ T852] [ 30.878425][ T839] EXT4-fs (loop4): 1 orphan inode deleted [pid 847] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 846] <... futex resumed>) = 0 [pid 846] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 853] <... futex resumed>) = 0 [pid 846] <... futex resumed>) = 1 ./strace-static-x86_64: Process 861 attached [pid 853] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 846] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 861] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 861] memfd_create("syzkaller", 0) = 3 [pid 861] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 861] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 861] munmap(0x7f35d66dd000, 262144) = 0 [pid 861] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 861] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 861] close(3) = 0 [pid 861] mkdir("./file1", 0777) = 0 [pid 861] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"..../strace-static-x86_64: Process 862 attached [pid 862] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 862] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 862] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 847] <... futex resumed>) = 0 [pid 847] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 847] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 853] <... write resumed>) = 262144 [pid 862] <... futex resumed>) = 1 [pid 862] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 862] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 847] <... futex resumed>) = 0 [pid 847] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 847] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 862] <... futex resumed>) = 1 [pid 862] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 862] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 847] <... futex resumed>) = 0 [pid 847] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 847] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 862] <... futex resumed>) = 1 [ 30.883972][ T839] EXT4-fs (loop4): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 30.913196][ T841] EXT4-fs (loop2): 1 orphan inode deleted [ 30.918772][ T861] loop3: detected capacity change from 0 to 512 [ 30.925245][ T861] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 30.925245][ T861] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 30.925245][ T861] [pid 862] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = 262144 [pid 853] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 839] <... mount resumed>) = 0 [pid 839] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 839] chdir("./file1") = 0 [pid 839] ioctl(6, LOOP_CLR_FD) = 0 [pid 839] close(6) = 0 [pid 839] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 839] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 837] exit_group(0 [pid 840] <... futex resumed>) = ? [pid 837] <... exit_group resumed>) = ? [pid 840] +++ exited with 0 +++ [pid 839] <... futex resumed>) = ? [pid 839] +++ exited with 0 +++ [pid 837] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=837, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 299] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 299] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 862] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 853] <... futex resumed>) = 1 [pid 847] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 846] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 853] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 862] <... futex resumed>) = 0 [pid 862] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./23/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] unlink("./23/bus") = 0 [pid 299] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./23/binderfs") = 0 [ 30.937654][ T839] ext4 filesystem being mounted at /root/syzkaller.RJEgPO/23/file1 supports timestamps until 2038 (0x7fffffff) [ 30.947522][ T852] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 30.959636][ T841] EXT4-fs (loop2): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 30.989658][ T861] EXT4-fs (loop3): Magic mismatch, very weird! [pid 299] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 861] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 844] +++ exited with 0 +++ [pid 842] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=842, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 296] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 841] <... mount resumed>) = 0 [pid 841] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 841] chdir("./file1") = 0 [pid 841] ioctl(6, LOOP_CLR_FD) = 0 [pid 841] close(6) = 0 [pid 841] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 841] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 861] ioctl(4, LOOP_CLR_FD) = 0 [pid 861] close(4 [pid 296] <... umount2 resumed>) = 0 [pid 838] exit_group(0 [pid 861] <... close resumed>) = 0 [pid 296] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 861] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 861] <... futex resumed>) = 0 [pid 296] lstat("./20/bus", [pid 861] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] unlink("./20/bus") = 0 [pid 296] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./20/binderfs") = 0 [pid 296] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] lstat("./20/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./20/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 296] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./20/file1") = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./20") = 0 [pid 296] mkdir("./21", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 865 ./strace-static-x86_64: Process 865 attached [pid 865] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 865] chdir("./21") = 0 [pid 865] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 865] setpgid(0, 0) = 0 [pid 865] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 865] write(3, "1000", 4) = 4 [pid 865] close(3) = 0 [pid 865] symlink("/dev/binderfs", "./binderfs") = 0 [pid 865] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 865] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 838] <... exit_group resumed>) = ? [pid 841] <... futex resumed>) = 230 [pid 843] <... futex resumed>) = ? [pid 865] <... mmap resumed>) = 0x7f35deafe000 [pid 865] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 843] +++ exited with 0 +++ [pid 865] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 841] +++ exited with 0 +++ [pid 865] <... clone resumed>, parent_tid=[866], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 866 [pid 865] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 865] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 865] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 838] +++ exited with 0 +++ [pid 865] <... mmap resumed>) = 0x7f35deadd000 [pid 865] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=838, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 865] <... mprotect resumed>) = 0 [pid 865] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 847] exit_group(0) = ? [pid 862] <... futex resumed>) = ? [pid 861] <... futex resumed>) = ? [pid 861] +++ exited with 0 +++ [pid 865] <... clone resumed>, parent_tid=[867], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 867 [pid 865] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 865] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 866 attached [pid 866] set_robust_list(0x7f35deb1e9e0, 24 [pid 297] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 866] <... set_robust_list resumed>) = 0 [pid 866] memfd_create("syzkaller", 0) = 3 [pid 866] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 297] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 866] <... mmap resumed>) = 0x7f35d66dd000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 297] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./22/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] unlink("./22/bus" [pid 866] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 866] munmap(0x7f35d66dd000, 262144) = 0 [pid 866] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 866] ioctl(4, LOOP_SET_FD, 3 [pid 297] <... unlink resumed>) = 0 [pid 866] <... ioctl resumed>) = 0 [pid 866] close(3) = 0 [pid 866] mkdir("./file1", 0777) = 0 [pid 866] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 852] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 852] ioctl(4, LOOP_CLR_FD) = 0 [pid 852] close(4) = 0 [pid 852] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 852] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 867 attached [pid 867] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 867] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 867] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 865] <... futex resumed>) = 0 [pid 865] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 865] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 867] <... futex resumed>) = 1 [pid 867] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 867] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 865] <... futex resumed>) = 0 [pid 865] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 865] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 867] <... futex resumed>) = 1 [pid 867] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 867] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 865] <... futex resumed>) = 0 [pid 865] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 865] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 867] <... futex resumed>) = 1 [pid 867] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 846] exit_group(0 [pid 852] <... futex resumed>) = ? [pid 846] <... exit_group resumed>) = ? [pid 852] +++ exited with 0 +++ [pid 297] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./22/binderfs") = 0 [ 30.991514][ T841] ext4 filesystem being mounted at /root/syzkaller.7ngmbG/22/file1 supports timestamps until 2038 (0x7fffffff) [ 30.995808][ T852] EXT4-fs (loop0): group descriptors corrupted! [ 31.027182][ T850] EXT4-fs (loop5): 1 orphan inode deleted [ 31.028869][ T866] loop1: detected capacity change from 0 to 512 [pid 297] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 859] <... futex resumed>) = ? [pid 853] <... futex resumed>) = ? [pid 862] +++ exited with 0 +++ [pid 847] +++ exited with 0 +++ [pid 859] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=847, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 298] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 298] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 865] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 298] lstat("./22/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] unlink("./22/bus") = 0 [pid 298] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] unlink("./22/binderfs") = 0 [pid 298] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 850] <... mount resumed>) = 0 [pid 850] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 850] chdir("./file1") = 0 [pid 850] ioctl(6, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] lstat("./22/file1", [pid 850] <... ioctl resumed>) = 0 [pid 850] close(6 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./22/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./22/file1" [pid 850] <... close resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./22" [pid 850] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... rmdir resumed>) = 0 [pid 848] exit_group(0 [pid 298] mkdir("./23", 0777 [pid 851] <... futex resumed>) = ? [pid 848] <... exit_group resumed>) = ? [pid 851] +++ exited with 0 +++ [pid 298] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 850] <... futex resumed>) = ? [pid 298] <... close resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 868 [pid 850] +++ exited with 0 +++ [pid 848] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=848, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 300] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 300] umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 300] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 867] <... write resumed>) = 262144 [pid 300] umount2("./20/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 867] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 867] <... futex resumed>) = 0 [pid 300] lstat("./20/bus", [pid 867] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] unlink("./20/bus") = 0 [pid 300] umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] lstat("./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 31.036220][ T850] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 31.048624][ T866] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 31.048624][ T866] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 31.048624][ T866] [ 31.084770][ T850] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/20/file1 supports timestamps until 2038 (0x7fffffff) [pid 300] unlink("./20/binderfs") = 0 [pid 300] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 868 attached [pid 868] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 868] chdir("./23") = 0 [pid 868] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 868] setpgid(0, 0) = 0 [pid 868] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 868] write(3, "1000", 4) = 4 [pid 868] close(3) = 0 [pid 868] symlink("/dev/binderfs", "./binderfs") = 0 [pid 868] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 868] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 868] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 868] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[869], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 869 [pid 868] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 868] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 868] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 868] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 868] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[870], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 870 [pid 868] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 853] +++ exited with 0 +++ [pid 846] +++ exited with 0 +++ [pid 299] <... umount2 resumed>) = 0 [pid 299] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=846, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] lstat("./23/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] openat(AT_FDCWD, "./23/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... openat resumed>) = 3 [pid 299] <... openat resumed>) = 4 [pid 295] fstat(3, [pid 299] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] getdents64(4, [pid 295] getdents64(3, [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] getdents64(4, [pid 295] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./23/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./23") = 0 [pid 299] mkdir("./24", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 871 ./strace-static-x86_64: Process 871 attached ./strace-static-x86_64: Process 870 attached ./strace-static-x86_64: Process 869 attached [pid 868] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 866] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 869] set_robust_list(0x7f35deb1e9e0, 24 [pid 866] ioctl(4, LOOP_CLR_FD [pid 869] <... set_robust_list resumed>) = 0 [pid 866] <... ioctl resumed>) = 0 [pid 869] memfd_create("syzkaller", 0 [pid 866] close(4 [pid 869] <... memfd_create resumed>) = 3 [pid 866] <... close resumed>) = 0 [pid 869] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 866] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 869] <... mmap resumed>) = 0x7f35d66dd000 [pid 866] <... futex resumed>) = 0 [pid 869] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 866] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 869] <... write resumed>) = 262144 [pid 869] munmap(0x7f35d66dd000, 262144 [pid 870] set_robust_list(0x7f35deafd9e0, 24 [pid 869] <... munmap resumed>) = 0 [pid 870] <... set_robust_list resumed>) = 0 [pid 869] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 870] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 869] <... openat resumed>) = 4 [pid 870] <... open resumed>) = 5 [pid 869] ioctl(4, LOOP_SET_FD, 3 [pid 870] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 870] <... futex resumed>) = 1 [pid 868] <... futex resumed>) = 0 [pid 865] exit_group(0 [pid 870] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 868] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 870] <... mount resumed>) = 0 [pid 868] <... futex resumed>) = 0 [pid 867] <... futex resumed>) = ? [pid 866] <... futex resumed>) = ? [pid 865] <... exit_group resumed>) = ? [pid 295] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 870] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 868] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 867] +++ exited with 0 +++ [pid 297] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 870] <... futex resumed>) = 0 [pid 868] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 870] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 868] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 868] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 871] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 871] chdir("./24") = 0 [pid 871] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./22/file1", [pid 295] lstat("./21/bus", [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] unlink("./21/bus" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 871] setpgid(0, 0 [pid 295] <... unlink resumed>) = 0 [pid 297] openat(AT_FDCWD, "./22/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... openat resumed>) = 4 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] fstat(4, [pid 295] lstat("./21/binderfs", [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] getdents64(4, [pid 295] unlink("./21/binderfs" [pid 871] <... setpgid resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 871] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] getdents64(4, [pid 295] <... unlink resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] close(4 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... close resumed>) = 0 [pid 295] lstat("./21/file1", [pid 297] rmdir("./22/file1" [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 295] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(3, [pid 871] <... openat resumed>) = 3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] openat(AT_FDCWD, "./21/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] close(3 [pid 871] write(3, "1000", 4 [pid 295] <... openat resumed>) = 4 [pid 297] <... close resumed>) = 0 [pid 295] fstat(4, [pid 297] rmdir("./22" [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 871] <... write resumed>) = 4 [pid 871] close(3) = 0 [pid 871] symlink("/dev/binderfs", "./binderfs") = 0 [pid 297] <... rmdir resumed>) = 0 [pid 295] getdents64(4, [pid 297] mkdir("./23", 0777 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 871] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 871] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 297] <... mkdir resumed>) = 0 [pid 295] getdents64(4, [pid 871] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 871] <... mprotect resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 295] close(4 [pid 297] ioctl(3, LOOP_CLR_FD [pid 871] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 870] <... open resumed>) = 6 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... close resumed>) = 0 [pid 870] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] close(3 [pid 295] rmdir("./21/file1" [pid 871] <... clone resumed>, parent_tid=[872], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 872 [pid 870] <... futex resumed>) = 1 [pid 868] <... futex resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 871] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 870] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 868] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 871] <... futex resumed>) = 0 [pid 870] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 868] <... futex resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... rmdir resumed>) = 0 [pid 871] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 870] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 868] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 873 attached ./strace-static-x86_64: Process 872 attached [pid 869] <... ioctl resumed>) = 0 [pid 295] getdents64(3, [pid 873] set_robust_list(0x555556c9c5e0, 24 [pid 872] set_robust_list(0x7f35deb1e9e0, 24 [pid 869] close(3 [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 873 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 873] <... set_robust_list resumed>) = 0 [pid 871] <... futex resumed>) = 0 [pid 870] <... write resumed>) = 262144 [pid 871] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 870] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 871] <... mmap resumed>) = 0x7f35deadd000 [pid 870] <... futex resumed>) = 1 [pid 868] <... futex resumed>) = 0 [pid 871] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 870] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 869] <... close resumed>) = 0 [pid 873] chdir("./23" [pid 872] <... set_robust_list resumed>) = 0 [pid 295] close(3 [pid 871] <... mprotect resumed>) = 0 [pid 869] mkdir("./file1", 0777 [pid 871] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 295] <... close resumed>) = 0 [pid 871] <... clone resumed>, parent_tid=[874], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 874 [pid 871] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 869] <... mkdir resumed>) = 0 [pid 295] rmdir("./21" [pid 871] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 874 attached [pid 874] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 874] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 869] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 295] <... rmdir resumed>) = 0 [pid 295] mkdir("./22", 0777 [pid 874] <... open resumed>) = 3 [pid 874] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 871] <... futex resumed>) = 0 [pid 871] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 871] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 874] <... futex resumed>) = 1 [pid 874] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 874] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 871] <... futex resumed>) = 0 [pid 871] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 871] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 874] <... futex resumed>) = 1 [pid 874] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 295] <... mkdir resumed>) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 874] <... open resumed>) = 4 [pid 874] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 871] <... futex resumed>) = 0 [pid 871] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 871] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 874] <... futex resumed>) = 1 [pid 874] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 874] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 871] <... futex resumed>) = 0 [pid 874] <... futex resumed>) = 1 [pid 874] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 873] <... chdir resumed>) = 0 [pid 873] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 873] setpgid(0, 0) = 0 [pid 873] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 873] write(3, "1000", 4) = 4 [pid 873] close(3) = 0 [pid 873] symlink("/dev/binderfs", "./binderfs") = 0 [pid 873] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 873] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 873] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 873] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[875], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 875 [pid 873] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 873] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 873] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 873] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 873] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[876], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 876 [pid 873] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 873] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 875 attached [pid 875] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 875] memfd_create("syzkaller", 0) = 3 [pid 875] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 875] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 295] <... openat resumed>) = 3 [pid 295] ioctl(3, LOOP_CLR_FD [pid 875] <... write resumed>) = 262144 [pid 875] munmap(0x7f35d66dd000, 262144 [pid 872] memfd_create("syzkaller", 0 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) ./strace-static-x86_64: Process 876 attached [pid 869] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 875] <... munmap resumed>) = 0 [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 876] set_robust_list(0x7f35deafd9e0, 24 [pid 872] <... memfd_create resumed>) = 5 [pid 869] ioctl(4, LOOP_CLR_FD [pid 875] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 875] ioctl(4, LOOP_SET_FD, 3 [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 877 [pid 872] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 876] <... set_robust_list resumed>) = 0 [pid 869] <... ioctl resumed>) = 0 [ 31.109315][ T866] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 31.120097][ T866] EXT4-fs (loop1): group descriptors corrupted! [ 31.130891][ T869] loop3: detected capacity change from 0 to 512 [ 31.151309][ T869] EXT4-fs (loop3): VFS: Can't find ext4 filesystem [pid 876] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 872] <... mmap resumed>) = 0x7f35d66dd000 [pid 869] close(4./strace-static-x86_64: Process 877 attached [pid 877] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 877] chdir("./22") = 0 [pid 877] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 877] setpgid(0, 0) = 0 [pid 877] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 877] write(3, "1000", 4) = 4 [pid 877] close(3) = 0 [pid 877] symlink("/dev/binderfs", "./binderfs") = 0 [pid 877] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 877] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 872] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 869] <... close resumed>) = 0 [pid 877] <... mmap resumed>) = 0x7f35deafe000 [pid 876] <... open resumed>) = 5 [pid 875] <... ioctl resumed>) = 0 [pid 872] <... write resumed>) = 262144 [pid 866] +++ exited with 0 +++ [pid 865] +++ exited with 0 +++ [pid 300] <... umount2 resumed>) = 0 [pid 300] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=865, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 877] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 877] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 300] lstat("./20/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 877] <... clone resumed>, parent_tid=[878], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 878 [pid 300] umount2("./20/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW [pid 877] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 877] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./20/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 877] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 877] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 877] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[879], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 879 [pid 877] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 877] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 869] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 869] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 875] close(3) = 0 [pid 875] mkdir("./file1", 0777 [pid 868] exit_group(0 [pid 870] <... futex resumed>) = ? [pid 868] <... exit_group resumed>) = ? [pid 870] +++ exited with 0 +++ [pid 869] <... futex resumed>) = ? [pid 300] <... openat resumed>) = 4 [pid 296] <... openat resumed>) = 3 [pid 300] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] fstat(3, [pid 872] munmap(0x7f35d66dd000, 262144 [pid 300] getdents64(4, [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 876] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] close(4 [pid 296] <... umount2 resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 296] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] rmdir("./20/file1" [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 873] <... futex resumed>) = 0 [pid 873] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... rmdir resumed>) = 0 [pid 296] lstat("./21/bus", [pid 873] <... futex resumed>) = 0 [pid 873] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] getdents64(3, [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 872] <... munmap resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] unlink("./21/bus" [pid 300] close(3 [pid 296] <... unlink resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 296] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 876] <... futex resumed>) = 1 [pid 876] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] rmdir("./20" [pid 296] lstat("./21/binderfs", [pid 876] <... mount resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 300] mkdir("./21", 0777 [pid 296] unlink("./21/binderfs" [pid 876] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 873] <... futex resumed>) = 0 [pid 873] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 873] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... mkdir resumed>) = 0 [pid 876] <... futex resumed>) = 1 [pid 876] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 296] <... unlink resumed>) = 0 [pid 876] <... open resumed>) = 3 [pid 300] <... openat resumed>) = 3 [pid 296] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] ioctl(3, LOOP_CLR_FD [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] lstat("./21/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] close(3 [pid 296] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 876] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "./21/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 875] <... mkdir resumed>) = 0 [pid 296] <... openat resumed>) = 4 [pid 873] <... futex resumed>) = 0 [pid 873] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 873] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 876] <... futex resumed>) = 1 [pid 296] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(4, [pid 875] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 876] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 296] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 296] close(4 [pid 872] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 880 [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./21/file1" [pid 872] <... openat resumed>) = 6 [pid 296] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 880 attached ./strace-static-x86_64: Process 879 attached ./strace-static-x86_64: Process 878 attached [pid 872] ioctl(6, LOOP_SET_FD, 5 [pid 296] getdents64(3, [pid 880] set_robust_list(0x555556c9c5e0, 24 [pid 879] set_robust_list(0x7f35deafd9e0, 24 [pid 878] set_robust_list(0x7f35deb1e9e0, 24 [pid 876] <... write resumed>) = 262144 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 880] <... set_robust_list resumed>) = 0 [pid 879] <... set_robust_list resumed>) = 0 [pid 878] <... set_robust_list resumed>) = 0 [pid 296] close(3 [pid 880] chdir("./21" [pid 879] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 878] memfd_create("syzkaller", 0 [pid 296] <... close resumed>) = 0 [pid 880] <... chdir resumed>) = 0 [pid 879] <... open resumed>) = 3 [pid 878] <... memfd_create resumed>) = 4 [pid 872] <... ioctl resumed>) = 0 [pid 296] rmdir("./21" [pid 880] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 879] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 878] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 872] close(5 [pid 296] <... rmdir resumed>) = 0 [pid 880] <... prctl resumed>) = 0 [pid 879] <... futex resumed>) = 1 [pid 878] <... mmap resumed>) = 0x7f35d66dd000 [pid 872] <... close resumed>) = 0 [pid 296] mkdir("./22", 0777 [pid 880] setpgid(0, 0 [pid 879] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 878] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 872] mkdir("./file1", 0777 [pid 296] <... mkdir resumed>) = 0 [pid 880] <... setpgid resumed>) = 0 [pid 878] <... write resumed>) = 262144 [pid 877] <... futex resumed>) = 0 [pid 876] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 875] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 880] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 878] munmap(0x7f35d66dd000, 262144 [pid 872] <... mkdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 880] <... openat resumed>) = 3 [pid 878] <... munmap resumed>) = 0 [pid 877] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 876] <... futex resumed>) = 1 [pid 875] ioctl(4, LOOP_CLR_FD [pid 873] <... futex resumed>) = 0 [pid 872] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 296] ioctl(3, LOOP_CLR_FD [pid 880] write(3, "1000", 4 [pid 879] <... futex resumed>) = 0 [pid 878] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 877] <... futex resumed>) = 1 [pid 876] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 875] <... ioctl resumed>) = 0 [ 31.159782][ T875] loop2: detected capacity change from 0 to 512 [ 31.192203][ T872] loop4: detected capacity change from 0 to 512 [ 31.199440][ T875] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [pid 877] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 875] close(4) = 0 [pid 875] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 875] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 873] exit_group(0 [pid 876] <... futex resumed>) = ? [pid 875] <... futex resumed>) = ? [pid 873] <... exit_group resumed>) = ? [pid 876] +++ exited with 0 +++ [pid 875] +++ exited with 0 +++ [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 880] <... write resumed>) = 4 [pid 879] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 878] <... openat resumed>) = 5 [pid 296] close(3 [pid 880] close(3 [pid 879] <... mount resumed>) = 0 [pid 878] ioctl(5, LOOP_SET_FD, 4 [pid 880] <... close resumed>) = 0 [pid 879] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 880] symlink("/dev/binderfs", "./binderfs") = 0 [pid 880] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 880] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 880] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 880] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[881], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 881 [pid 880] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 880] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 880] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 880] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 880] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[882], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 882 [pid 880] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 880] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 882 attached [pid 882] set_robust_list(0x7f35deafd9e0, 24 [pid 878] <... ioctl resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 881 attached ./strace-static-x86_64: Process 883 attached [pid 882] <... set_robust_list resumed>) = 0 [pid 879] <... futex resumed>) = 1 [pid 878] close(4 [pid 877] <... futex resumed>) = 0 [pid 881] set_robust_list(0x7f35deb1e9e0, 24 [pid 879] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 878] <... close resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 883 [pid 881] <... set_robust_list resumed>) = 0 [pid 878] mkdir("./file1", 0777 [pid 883] set_robust_list(0x555556c9c5e0, 24 [pid 882] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 877] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 869] +++ exited with 0 +++ [pid 868] +++ exited with 0 +++ [pid 877] <... futex resumed>) = 1 [pid 877] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=868, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 298] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 298] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./23/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] unlink("./23/bus") = 0 [pid 298] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 882] <... open resumed>) = 3 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 882] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] lstat("./23/binderfs", [pid 882] <... futex resumed>) = 1 [pid 880] <... futex resumed>) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 882] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 880] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 879] <... futex resumed>) = 0 [pid 878] <... mkdir resumed>) = 0 [pid 298] unlink("./23/binderfs" [pid 882] <... mount resumed>) = 0 [pid 881] memfd_create("syzkaller", 0 [pid 880] <... futex resumed>) = 0 [pid 879] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 878] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 298] <... unlink resumed>) = 0 [pid 882] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 881] <... memfd_create resumed>) = 4 [pid 880] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 879] <... open resumed>) = 4 [pid 298] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 882] <... futex resumed>) = 0 [pid 880] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 882] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 880] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] lstat("./23/file1", [pid 882] <... open resumed>) = 5 [pid 880] <... futex resumed>) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 882] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 880] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 883] <... set_robust_list resumed>) = 0 [pid 882] <... futex resumed>) = 0 [pid 880] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 883] chdir("./22" [pid 882] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 880] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] openat(AT_FDCWD, "./23/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 883] <... chdir resumed>) = 0 [pid 882] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 880] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 883] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 882] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 880] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] fstat(4, [pid 883] <... prctl resumed>) = 0 [pid 882] <... futex resumed>) = 0 [pid 880] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 883] setpgid(0, 0 [pid 882] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] getdents64(4, [pid 883] <... setpgid resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 883] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] getdents64(4, [pid 883] <... openat resumed>) = 3 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 883] write(3, "1000", 4 [pid 298] close(4 [pid 883] <... write resumed>) = 4 [pid 298] <... close resumed>) = 0 [pid 883] close(3 [pid 298] rmdir("./23/file1" [pid 883] <... close resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 883] symlink("/dev/binderfs", "./binderfs" [pid 298] getdents64(3, [pid 883] <... symlink resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 883] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 883] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 883] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [ 31.208867][ T872] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 31.208867][ T872] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 31.208867][ T872] [ 31.229380][ T878] loop0: detected capacity change from 0 to 512 [ 31.248736][ T878] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [pid 298] rmdir("./23" [pid 883] <... mmap resumed>) = 0x7f35deafe000 [pid 298] <... rmdir resumed>) = 0 [pid 883] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 298] mkdir("./24", 0777 [pid 883] <... mprotect resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 883] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 883] <... clone resumed>, parent_tid=[886], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 886 [pid 298] ioctl(3, LOOP_CLR_FD [pid 883] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 883] <... futex resumed>) = 0 [pid 298] close(3 [pid 883] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 883] <... futex resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 883] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 887 [pid 883] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 883] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[888], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 888 [pid 883] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 883] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 887 attached [pid 887] set_robust_list(0x555556c9c5e0, 24 [pid 879] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 881] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 879] <... futex resumed>) = 1 [pid 877] <... futex resumed>) = 0 [pid 881] <... mmap resumed>) = 0x7f35d66dd000 [pid 879] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 877] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 879] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 877] <... futex resumed>) = 0 [pid 879] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 877] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 887] <... set_robust_list resumed>) = 0 [pid 887] chdir("./24") = 0 [pid 887] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 887] setpgid(0, 0) = 0 ./strace-static-x86_64: Process 886 attached [pid 887] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 886] set_robust_list(0x7f35deb1e9e0, 24 [pid 887] write(3, "1000", 4 [pid 886] <... set_robust_list resumed>) = 0 [pid 887] <... write resumed>) = 4 [pid 886] memfd_create("syzkaller", 0 [pid 887] close(3 [pid 886] <... memfd_create resumed>) = 3 [pid 887] <... close resumed>) = 0 [pid 886] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 887] symlink("/dev/binderfs", "./binderfs" [pid 886] <... mmap resumed>) = 0x7f35d66dd000 [pid 887] <... symlink resumed>) = 0 [pid 886] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 881] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 887] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 887] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 873] +++ exited with 0 +++ [pid 887] <... mmap resumed>) = 0x7f35deafe000 [pid 887] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 881] <... write resumed>) = 262144 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=873, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 887] <... mprotect resumed>) = 0 [pid 881] munmap(0x7f35d66dd000, 262144 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 887] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 881] <... munmap resumed>) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 881] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 887] <... clone resumed>, parent_tid=[889], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 889 [pid 881] <... openat resumed>) = 6 [pid 887] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 881] ioctl(6, LOOP_SET_FD, 4 [pid 297] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 887] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 887] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 887] <... futex resumed>) = 0 [pid 886] <... write resumed>) = 262144 [pid 297] <... openat resumed>) = 3 [pid 887] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 886] munmap(0x7f35d66dd000, 262144 [pid 297] fstat(3, [pid 887] <... mmap resumed>) = 0x7f35deadd000 [pid 886] <... munmap resumed>) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 887] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 886] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 297] getdents64(3, [pid 887] <... mprotect resumed>) = 0 [pid 886] <... openat resumed>) = 4 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 887] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 886] ioctl(4, LOOP_SET_FD, 3 [pid 297] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 888 attached [pid 879] <... write resumed>) = 262144 [pid 887] <... clone resumed>, parent_tid=[890], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 890 [pid 887] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 887] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 889 attached [pid 889] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 889] memfd_create("syzkaller", 0) = 3 [pid 889] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 886] <... ioctl resumed>) = 0 [pid 886] close(3) = 0 [pid 886] mkdir("./file1", 0777 [pid 297] <... umount2 resumed>) = 0 [pid 886] <... mkdir resumed>) = 0 [pid 297] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [ 31.248736][ T878] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 31.248736][ T878] [ 31.281614][ T881] loop5: detected capacity change from 0 to 512 [ 31.285960][ T886] loop1: detected capacity change from 0 to 512 [ 31.294122][ T872] EXT4-fs (loop4): 1 orphan inode deleted [ 31.301777][ T886] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [pid 886] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 888] set_robust_list(0x7f35deafd9e0, 24 [pid 883] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 879] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 877] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 297] lstat("./23/bus", [pid 889] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 883] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 ./strace-static-x86_64: Process 890 attached [pid 883] <... futex resumed>) = 0 [pid 297] unlink("./23/bus" [pid 890] set_robust_list(0x7f35deafd9e0, 24 [pid 883] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... unlink resumed>) = 0 [pid 890] <... set_robust_list resumed>) = 0 [pid 889] <... write resumed>) = 262144 [pid 883] <... mmap resumed>) = 0x7f35d66fc000 [pid 297] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 890] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 883] mprotect(0x7f35d66fd000, 131072, PROT_READ|PROT_WRITE [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 890] <... open resumed>) = 4 [pid 883] <... mprotect resumed>) = 0 [pid 297] lstat("./23/binderfs", [pid 890] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 883] clone(child_stack=0x7f35d671c3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 890] <... futex resumed>) = 1 [pid 887] <... futex resumed>) = 0 [pid 297] unlink("./23/binderfs" [pid 890] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 889] munmap(0x7f35d66dd000, 262144 [pid 887] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 883] <... clone resumed>, parent_tid=[891], tls=0x7f35d671c700, child_tidptr=0x7f35d671c9d0) = 891 [pid 297] <... unlink resumed>) = 0 [pid 890] <... mount resumed>) = 0 [pid 889] <... munmap resumed>) = 0 [pid 887] <... futex resumed>) = 0 [pid 883] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 890] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 889] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 887] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 883] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 890] <... futex resumed>) = 0 [pid 889] <... openat resumed>) = 5 [pid 887] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 883] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] lstat("./23/file1", [ 31.301777][ T886] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 31.301777][ T886] [ 31.308852][ T872] EXT4-fs (loop4): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 31.330095][ T889] loop3: detected capacity change from 0 to 512 [ 31.342639][ T872] ext4 filesystem being mounted at /root/syzkaller.RJEgPO/24/file1 supports timestamps until 2038 (0x7fffffff) [pid 890] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 889] ioctl(5, LOOP_SET_FD, 3 [pid 887] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 890] <... open resumed>) = 6 [pid 888] <... set_robust_list resumed>) = 0 [pid 887] <... futex resumed>) = 0 [pid 879] <... futex resumed>) = 0 [pid 297] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 888] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 887] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 879] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 890] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 888] <... open resumed>) = 3 [pid 887] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] openat(AT_FDCWD, "./23/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 890] <... futex resumed>) = 0 [pid 888] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 887] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... openat resumed>) = 4 [pid 890] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 888] <... futex resumed>) = 0 [pid 887] <... futex resumed>) = 0 [pid 297] fstat(4, ./strace-static-x86_64: Process 891 attached [pid 889] <... ioctl resumed>) = 0 [pid 888] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 887] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 881] <... ioctl resumed>) = 0 [pid 872] <... mount resumed>) = 0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 881] close(4 [pid 297] getdents64(4, [pid 891] set_robust_list(0x7f35d671c9e0, 24 [pid 889] close(3 [pid 881] <... close resumed>) = 0 [pid 872] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 881] mkdir("./file1", 0777 [pid 297] getdents64(4, [pid 881] <... mkdir resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 881] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 297] close(4 [pid 891] <... set_robust_list resumed>) = 0 [pid 889] <... close resumed>) = 0 [pid 883] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 872] <... openat resumed>) = 5 [pid 891] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 889] mkdir("./file1", 0777 [pid 872] chdir("./file1" [pid 891] <... mount resumed>) = 0 [pid 889] <... mkdir resumed>) = 0 [pid 872] <... chdir resumed>) = 0 [pid 891] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 889] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 872] ioctl(6, LOOP_CLR_FD [pid 891] <... futex resumed>) = 0 [pid 872] <... ioctl resumed>) = 0 [pid 891] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 872] close(6) = 0 [pid 872] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 872] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... close resumed>) = 0 [pid 883] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 871] exit_group(0 [pid 297] rmdir("./23/file1" [pid 878] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 878] ioctl(5, LOOP_CLR_FD) = 0 [pid 878] close(5 [pid 883] <... futex resumed>) = 1 [pid 890] <... write resumed>) = -1 EIO (Input/output error) [pid 883] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 878] <... close resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 871] <... exit_group resumed>) = ? [pid 872] <... futex resumed>) = ? [pid 874] <... futex resumed>) = ? [pid 872] +++ exited with 0 +++ [pid 890] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 874] +++ exited with 0 +++ [pid 871] +++ exited with 0 +++ [pid 297] getdents64(3, [pid 890] <... futex resumed>) = 1 [pid 887] <... futex resumed>) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=871, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 890] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [ 31.352346][ T890] blk_update_request: I/O error, dev loop3, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 31.374774][ T881] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 31.374774][ T881] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 31.374774][ T881] [ 31.394412][ T890] Buffer I/O error on dev loop3, logical block 0, lost async page write [ 31.396420][ T878] EXT4-fs (loop0): Magic mismatch, very weird! [pid 878] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 878] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 877] exit_group(0) = ? [pid 299] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 878] <... futex resumed>) = ? [pid 878] +++ exited with 0 +++ [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 879] <... futex resumed>) = ? [pid 299] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] close(3 [pid 299] <... openat resumed>) = 3 [pid 297] <... close resumed>) = 0 [pid 299] fstat(3, [pid 888] <... futex resumed>) = 0 [pid 879] +++ exited with 0 +++ [pid 877] +++ exited with 0 +++ [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] rmdir("./23" [pid 888] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 299] getdents64(3, [pid 297] <... rmdir resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=877, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 888] <... open resumed>) = 5 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] mkdir("./24", 0777 [pid 888] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... mkdir resumed>) = 0 [pid 888] <... futex resumed>) = 1 [pid 883] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 888] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 883] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... openat resumed>) = 3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 883] <... futex resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 295] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 883] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... openat resumed>) = 3 [pid 888] <... write resumed>) = 262144 [pid 299] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] close(3 [pid 295] fstat(3, [pid 888] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... close resumed>) = 0 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 888] <... futex resumed>) = 1 [pid 883] <... futex resumed>) = 0 [pid 299] lstat("./24/bus", [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] getdents64(3, [pid 888] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] unlink("./24/bus" [pid 297] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 897 [pid 295] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... unlink resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 299] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] lstat("./24/binderfs", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] lstat("./22/bus", [pid 299] unlink("./24/binderfs" [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] <... unlink resumed>) = 0 [pid 295] unlink("./22/bus" [pid 299] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... unlink resumed>) = 0 [pid 295] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [ 31.413788][ T889] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 31.413788][ T889] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 31.413788][ T889] [ 31.442008][ T886] EXT4-fs (loop1): 1 orphan inode deleted [pid 295] unlink("./22/binderfs"./strace-static-x86_64: Process 897 attached ) = 0 [pid 295] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 897] set_robust_list(0x555556c9c5e0, 24 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 897] <... set_robust_list resumed>) = 0 [pid 295] lstat("./22/file1", [pid 897] chdir("./24" [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 897] <... chdir resumed>) = 0 [pid 295] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 897] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 897] <... prctl resumed>) = 0 [pid 295] openat(AT_FDCWD, "./22/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 897] setpgid(0, 0 [pid 295] <... openat resumed>) = 4 [pid 897] <... setpgid resumed>) = 0 [pid 295] fstat(4, [pid 897] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 897] <... openat resumed>) = 3 [pid 295] getdents64(4, [pid 897] write(3, "1000", 4) = 4 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 897] close(3) = 0 [pid 295] getdents64(4, [pid 897] symlink("/dev/binderfs", "./binderfs" [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 897] <... symlink resumed>) = 0 [pid 295] close(4 [pid 889] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 889] ioctl(5, LOOP_CLR_FD) = 0 [pid 889] close(5) = 0 [pid 889] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 31.461973][ T886] EXT4-fs (loop1): mounted filesystem without journal. Opts: âÔ\y®¼411~iòòäÅɱ¾ôs$"®üé£ÿÿçµ?_yë··ß¿ùÉÙ5Óʶ?Ù~jw½Ðú]t FÄÊN; nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 31.462807][ T889] EXT4-fs (loop3): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 31.500073][ T889] EXT4-fs (loop3): group descriptors corrupted! [pid 889] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 897] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... close resumed>) = 0 [pid 897] <... futex resumed>) = 0 [pid 295] rmdir("./22/file1" [pid 897] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] <... rmdir resumed>) = 0 [pid 897] <... mmap resumed>) = 0x7f35deafe000 [pid 295] getdents64(3, [pid 897] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 897] <... mprotect resumed>) = 0 [pid 295] close(3 [pid 897] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 886] <... mount resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 887] exit_group(0) = ? [pid 886] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 6 [pid 886] chdir("./file1") = 0 [pid 886] ioctl(4, LOOP_CLR_FD) = 0 [pid 886] close(4) = 0 [pid 886] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 890] <... futex resumed>) = -1 (errno 18446744073709551414) [pid 883] exit_group(0 [pid 891] <... futex resumed>) = ? [pid 890] +++ exited with 0 +++ [pid 883] <... exit_group resumed>) = ? [pid 888] <... futex resumed>) = ? [pid 891] +++ exited with 0 +++ [pid 888] +++ exited with 0 +++ [pid 295] rmdir("./22" [pid 897] <... clone resumed>, parent_tid=[898], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 898 [pid 897] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... rmdir resumed>) = 0 [pid 295] mkdir("./23", 0777 [pid 897] <... futex resumed>) = 0 [pid 886] <... futex resumed>) = ? [pid 886] +++ exited with 0 +++ [pid 883] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=883, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 296] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 897] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = 0 [pid 296] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 897] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... mkdir resumed>) = 0 [pid 296] lstat("./22/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] unlink("./22/bus") = 0 [pid 897] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 897] <... mmap resumed>) = 0x7f35deadd000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 897] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 296] lstat("./22/binderfs", [pid 295] <... openat resumed>) = 3 [pid 897] <... mprotect resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 897] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] close(3 [pid 897] <... clone resumed>, parent_tid=[899], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 899 [pid 295] <... close resumed>) = 0 [pid 897] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = 0 [pid 296] unlink("./22/binderfs" [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 898 attached [pid 897] <... futex resumed>) = 0 [pid 889] <... futex resumed>) = ? [pid 299] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... unlink resumed>) = 0 [pid 897] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 900 ./strace-static-x86_64: Process 899 attached [pid 899] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 899] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 899] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 897] <... futex resumed>) = 0 [pid 897] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 897] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 899] <... futex resumed>) = 1 [pid 899] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 899] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 897] <... futex resumed>) = 0 [pid 897] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 897] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 899] <... futex resumed>) = 1 [pid 899] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 899] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 897] <... futex resumed>) = 0 [pid 897] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 897] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 899] <... futex resumed>) = 1 [pid 899] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 899] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 897] <... futex resumed>) = 0 [pid 899] <... futex resumed>) = 1 [pid 899] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] lstat("./24/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 31.510980][ T886] ext4 filesystem being mounted at /root/syzkaller.5s3MMz/22/file1 supports timestamps until 2038 (0x7fffffff) [ 31.527509][ T881] EXT4-fs (loop5): 1 orphan inode deleted [ 31.537531][ T881] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [pid 299] openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 900 attached [pid 898] set_robust_list(0x7f35deb1e9e0, 24 [pid 889] +++ exited with 0 +++ [pid 887] +++ exited with 0 +++ [pid 881] <... mount resumed>) = 0 [pid 299] <... openat resumed>) = 4 [pid 900] set_robust_list(0x555556c9c5e0, 24 [pid 898] <... set_robust_list resumed>) = 0 [pid 881] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 299] fstat(4, [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=887, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 900] <... set_robust_list resumed>) = 0 [pid 898] memfd_create("syzkaller", 0 [pid 881] <... openat resumed>) = 4 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 900] chdir("./23" [pid 898] <... memfd_create resumed>) = 5 [pid 881] chdir("./file1" [pid 299] getdents64(4, [pid 900] <... chdir resumed>) = 0 [pid 898] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 881] <... chdir resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 900] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 898] <... mmap resumed>) = 0x7f35d66dd000 [pid 881] ioctl(6, LOOP_CLR_FD [pid 299] getdents64(4, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 900] <... prctl resumed>) = 0 [pid 898] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 881] <... ioctl resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 900] setpgid(0, 0 [pid 898] <... write resumed>) = 262144 [pid 881] close(6 [pid 299] close(4 [pid 298] <... openat resumed>) = 3 [pid 900] <... setpgid resumed>) = 0 [pid 898] munmap(0x7f35d66dd000, 262144 [pid 881] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] fstat(3, [pid 900] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 898] <... munmap resumed>) = 0 [pid 881] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] rmdir("./24/file1" [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 900] <... openat resumed>) = 3 [pid 898] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 881] <... futex resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 298] getdents64(3, [pid 900] write(3, "1000", 4 [pid 898] <... openat resumed>) = 6 [pid 881] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] getdents64(3, [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 900] <... write resumed>) = 4 [pid 898] ioctl(6, LOOP_SET_FD, 5 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 900] close(3 [pid 299] close(3 [pid 298] <... umount2 resumed>) = 0 [pid 900] <... close resumed>) = 0 [pid 898] <... ioctl resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 900] symlink("/dev/binderfs", "./binderfs" [pid 898] close(5 [pid 299] rmdir("./24" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 900] <... symlink resumed>) = 0 [pid 898] <... close resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 298] lstat("./24/bus", [pid 900] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 898] mkdir("./file1", 0777 [pid 299] mkdir("./25", 0777 [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 900] <... futex resumed>) = 0 [pid 898] <... mkdir resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 298] unlink("./24/bus" [pid 900] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 898] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 298] <... unlink resumed>) = 0 [pid 900] <... mmap resumed>) = 0x7f35deafe000 [pid 299] <... openat resumed>) = 3 [pid 298] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 900] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 900] <... mprotect resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] lstat("./24/binderfs", [pid 900] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 299] close(3 [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] <... close resumed>) = 0 [pid 298] unlink("./24/binderfs" [pid 900] <... clone resumed>, parent_tid=[901], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 901 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... unlink resumed>) = 0 [pid 900] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 900] <... futex resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 902 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 900] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] lstat("./24/file1", [pid 900] <... futex resumed>) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 900] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 900] <... mmap resumed>) = 0x7f35deadd000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 900] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 298] openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 900] <... mprotect resumed>) = 0 [pid 298] <... openat resumed>) = 4 [ 31.562159][ T881] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/21/file1 supports timestamps until 2038 (0x7fffffff) [ 31.562255][ T296] EXT4-fs error (device loop1): __ext4_get_inode_loc:4350: comm syz-executor252: Invalid inode table block 0 in block_group 0 [ 31.587939][ T296] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5830: Corrupt filesystem [ 31.600182][ T898] loop2: detected capacity change from 0 to 512 [pid 900] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 900] <... clone resumed>, parent_tid=[903], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 903 [pid 298] getdents64(4, [pid 900] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 900] <... futex resumed>) = 0 [pid 298] getdents64(4, [pid 900] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./24/file1") = 0 [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 880] exit_group(0 [pid 298] rmdir("./24" [pid 882] <... futex resumed>) = ? [pid 881] <... futex resumed>) = ? [pid 880] <... exit_group resumed>) = ? [pid 298] <... rmdir resumed>) = 0 [pid 298] mkdir("./25", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR./strace-static-x86_64: Process 901 attached [pid 901] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 901] memfd_create("syzkaller", 0) = 3 [pid 901] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 882] +++ exited with 0 +++ [pid 881] +++ exited with 0 +++ [pid 880] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=880, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 300] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 300] umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 300] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 300] umount2("./21/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 903 attached ./strace-static-x86_64: Process 902 attached ) = -1 EINVAL (Invalid argument) [pid 300] lstat("./21/bus", [pid 901] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 901] munmap(0x7f35d66dd000, 262144) = 0 [pid 901] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 901] ioctl(4, LOOP_SET_FD, 3 [pid 903] set_robust_list(0x7f35deafd9e0, 24 [pid 902] set_robust_list(0x555556c9c5e0, 24 [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 903] <... set_robust_list resumed>) = 0 [pid 902] <... set_robust_list resumed>) = 0 [pid 300] unlink("./21/bus" [pid 903] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 902] chdir("./25" [pid 300] <... unlink resumed>) = 0 [pid 903] <... open resumed>) = 5 [pid 902] <... chdir resumed>) = 0 [pid 300] umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 903] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 902] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 903] <... futex resumed>) = 1 [pid 902] <... prctl resumed>) = 0 [pid 900] <... futex resumed>) = 0 [pid 300] lstat("./21/binderfs", [pid 903] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 902] setpgid(0, 0 [pid 900] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 903] <... mount resumed>) = 0 [pid 902] <... setpgid resumed>) = 0 [pid 900] <... futex resumed>) = 0 [pid 300] unlink("./21/binderfs" [pid 903] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 902] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 900] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... unlink resumed>) = 0 [pid 903] <... futex resumed>) = 0 [pid 902] <... openat resumed>) = 3 [pid 900] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 903] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 902] write(3, "1000", 4 [pid 900] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 902] <... write resumed>) = 4 [pid 900] <... futex resumed>) = 0 [pid 902] close(3 [pid 900] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 902] <... close resumed>) = 0 [pid 902] symlink("/dev/binderfs", "./binderfs") = 0 [pid 902] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 902] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 902] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 902] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[904], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 904 [pid 902] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 902] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 902] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 902] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 902] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 904 attached ./strace-static-x86_64: Process 905 attached [pid 903] <... open resumed>) = 6 [pid 901] <... ioctl resumed>) = 0 [pid 905] set_robust_list(0x7f35deafd9e0, 24 [pid 904] set_robust_list(0x7f35deb1e9e0, 24 [pid 903] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 902] <... clone resumed>, parent_tid=[905], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 905 [pid 901] close(3 [pid 904] <... set_robust_list resumed>) = 0 [pid 903] <... futex resumed>) = 1 [pid 902] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 900] <... futex resumed>) = 0 [pid 905] <... set_robust_list resumed>) = 0 [pid 904] memfd_create("syzkaller", 0 [pid 903] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 902] <... futex resumed>) = 0 [pid 901] <... close resumed>) = 0 [pid 900] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 904] <... memfd_create resumed>) = 3 [pid 903] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 902] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 901] mkdir("./file1", 0777 [pid 900] <... futex resumed>) = 0 [pid 900] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 908 [pid 905] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 905] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 902] <... futex resumed>) = 0 [pid 902] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 902] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 905] <... futex resumed>) = 1 [pid 905] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 905] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 902] <... futex resumed>) = 0 [pid 902] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 902] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 905] <... futex resumed>) = 1 [pid 905] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 905] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 902] <... futex resumed>) = 0 [pid 902] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 902] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 905] <... futex resumed>) = 1 [pid 905] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 905] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 902] <... futex resumed>) = 0 [pid 905] <... futex resumed>) = 1 [pid 905] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 908 attached [pid 908] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 908] chdir("./25" [pid 904] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 903] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 901] <... mkdir resumed>) = 0 [pid 908] <... chdir resumed>) = 0 [pid 908] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 908] setpgid(0, 0) = 0 [pid 908] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 908] write(3, "1000", 4) = 4 [pid 908] close(3) = 0 [pid 904] <... mmap resumed>) = 0x7f35d66dd000 [pid 901] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 908] symlink("/dev/binderfs", "./binderfs") = 0 [pid 908] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 908] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 908] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 908] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[909], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 909 [pid 908] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 908] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 908] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 908] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 904] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 908] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[910], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 910 [pid 908] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 908] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 910 attached [pid 910] set_robust_list(0x7f35deafd9e0, 24 [pid 296] <... umount2 resumed>) = 0 [pid 910] <... set_robust_list resumed>) = 0 [pid 296] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW [ 31.603626][ T296] EXT4-fs error (device loop1): ext4_quota_off:6461: inode #3: comm syz-executor252: mark_inode_dirty error [ 31.626683][ T898] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 31.626683][ T898] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 31.626683][ T898] [ 31.633746][ T901] loop0: detected capacity change from 0 to 512 [ 31.657081][ T898] EXT4-fs (loop2): 1 orphan inode deleted [pid 910] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 910] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 908] <... futex resumed>) = 0 [pid 908] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 908] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 910] <... futex resumed>) = 1 [pid 910] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 ./strace-static-x86_64: Process 909 attached [pid 909] set_robust_list(0x7f35deb1e9e0, 24 [pid 910] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 909] <... set_robust_list resumed>) = 0 [pid 908] <... futex resumed>) = 0 [pid 908] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 908] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 910] <... futex resumed>) = 1 [pid 909] memfd_create("syzkaller", 0 [pid 910] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 910] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 908] <... futex resumed>) = 0 [pid 908] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 908] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 909] <... memfd_create resumed>) = 5 [pid 910] <... futex resumed>) = 1 [pid 910] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 910] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 909] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 908] <... futex resumed>) = 0 [pid 910] <... futex resumed>) = 1 [pid 909] <... mmap resumed>) = 0x7f35d66dd000 [pid 910] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 901] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 904] <... write resumed>) = 262144 [pid 296] lstat("./22/file1", [pid 904] munmap(0x7f35d66dd000, 262144 [pid 903] <... write resumed>) = 262144 [pid 903] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 904] <... munmap resumed>) = 0 [pid 300] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 904] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 903] <... futex resumed>) = 1 [pid 900] <... futex resumed>) = 0 [pid 300] lstat("./21/file1", [pid 296] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] umount2("./21/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./22/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] openat(AT_FDCWD, "./21/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 296] <... openat resumed>) = 4 [pid 300] fstat(4, [pid 296] fstat(4, [pid 909] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 904] <... openat resumed>) = 6 [pid 903] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 904] ioctl(6, LOOP_SET_FD, 3 [pid 300] getdents64(4, [pid 909] <... write resumed>) = 262144 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] getdents64(4, [pid 296] getdents64(4, [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 909] munmap(0x7f35d66dd000, 262144 [pid 300] close(4) = 0 [pid 909] <... munmap resumed>) = 0 [pid 300] rmdir("./21/file1" [pid 909] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 300] <... rmdir resumed>) = 0 [pid 909] <... openat resumed>) = 6 [pid 300] getdents64(3, [pid 909] ioctl(6, LOOP_SET_FD, 5 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] close(3 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] <... close resumed>) = 0 [pid 296] getdents64(4, [pid 300] rmdir("./21" [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 296] close(4 [pid 300] mkdir("./22", 0777) = 0 [pid 296] <... close resumed>) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 296] rmdir("./22/file1" [pid 300] <... openat resumed>) = 3 [pid 300] ioctl(3, LOOP_CLR_FD [pid 296] <... rmdir resumed>) = 0 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] getdents64(3, [pid 300] close(3) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] close(3 [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 911 [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./22"./strace-static-x86_64: Process 911 attached ) = 0 [pid 296] mkdir("./23", 0777 [pid 911] set_robust_list(0x555556c9c5e0, 24 [pid 296] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 911] <... set_robust_list resumed>) = 0 [pid 911] chdir("./22") = 0 [pid 911] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 912 [pid 911] <... prctl resumed>) = 0 [pid 911] setpgid(0, 0) = 0 [pid 911] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 911] write(3, "1000", 4) = 4 [pid 911] close(3) = 0 [pid 911] symlink("/dev/binderfs", "./binderfs") = 0 [pid 911] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 911] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 911] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 911] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[913], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 913 [pid 911] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 912 attached [pid 911] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 912] set_robust_list(0x555556c9c5e0, 24 [pid 911] <... futex resumed>) = 0 [pid 912] <... set_robust_list resumed>) = 0 [pid 911] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 912] chdir("./23" [pid 911] <... mmap resumed>) = 0x7f35deadd000 [pid 912] <... chdir resumed>) = 0 [pid 911] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 912] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 911] <... mprotect resumed>) = 0 [pid 912] <... prctl resumed>) = 0 [pid 911] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 912] setpgid(0, 0) = 0 [pid 911] <... clone resumed>, parent_tid=[914], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 914 [pid 912] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 911] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 912] <... openat resumed>) = 3 [pid 911] <... futex resumed>) = 0 [pid 912] write(3, "1000", 4 [pid 911] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 912] <... write resumed>) = 4 [pid 912] close(3./strace-static-x86_64: Process 913 attached ) = 0 [pid 901] ioctl(4, LOOP_CLR_FD [pid 913] set_robust_list(0x7f35deb1e9e0, 24 [pid 912] symlink("/dev/binderfs", "./binderfs" [pid 913] <... set_robust_list resumed>) = 0 [pid 912] <... symlink resumed>) = 0 [pid 913] memfd_create("syzkaller", 0 [pid 912] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 901] <... ioctl resumed>) = 0 [pid 913] <... memfd_create resumed>) = 3 [pid 912] <... futex resumed>) = 0 [pid 901] close(4 [pid 904] <... ioctl resumed>) = 0 ./strace-static-x86_64: Process 914 attached [pid 913] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 912] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 914] set_robust_list(0x7f35deafd9e0, 24 [pid 913] <... mmap resumed>) = 0x7f35d66dd000 [pid 912] <... mmap resumed>) = 0x7f35deafe000 [pid 914] <... set_robust_list resumed>) = 0 [pid 913] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 912] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 901] <... close resumed>) = 0 [pid 914] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 912] <... mprotect resumed>) = 0 [pid 914] <... open resumed>) = 4 [ 31.677795][ T901] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [ 31.694374][ T904] loop4: detected capacity change from 0 to 512 [ 31.697044][ T909] loop3: detected capacity change from 0 to 512 [pid 912] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 904] close(3 [pid 901] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 914] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 912] <... clone resumed>, parent_tid=[915], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 915 [pid 911] <... futex resumed>) = 0 [pid 914] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 913] <... write resumed>) = 262144 [pid 912] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 911] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 914] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 912] <... futex resumed>) = 0 [pid 911] <... futex resumed>) = 0 [pid 900] exit_group(0 [pid 914] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 912] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 911] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 903] <... futex resumed>) = ? [pid 900] <... exit_group resumed>) = ? [pid 914] <... mount resumed>) = 0 [pid 912] <... futex resumed>) = 0 [pid 903] +++ exited with 0 +++ [pid 914] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 913] munmap(0x7f35d66dd000, 262144 [pid 912] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 909] <... ioctl resumed>) = 0 [pid 914] <... futex resumed>) = 1 [pid 913] <... munmap resumed>) = 0 [pid 912] <... mmap resumed>) = 0x7f35deadd000 [pid 911] <... futex resumed>) = 0 [pid 909] close(5 [pid 904] <... close resumed>) = 0 [pid 901] <... futex resumed>) = ? [pid 914] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 913] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 912] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 911] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 909] <... close resumed>) = 0 [pid 904] mkdir("./file1", 0777./strace-static-x86_64: Process 915 attached [pid 914] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 913] <... openat resumed>) = 5 [pid 912] <... mprotect resumed>) = 0 [pid 911] <... futex resumed>) = 0 [pid 909] mkdir("./file1", 0777 [pid 904] <... mkdir resumed>) = 0 [pid 915] set_robust_list(0x7f35deb1e9e0, 24 [pid 914] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 913] ioctl(5, LOOP_SET_FD, 3 [pid 912] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 911] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 909] <... mkdir resumed>) = 0 [pid 904] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 915] <... set_robust_list resumed>) = 0 [pid 914] <... open resumed>) = 6 [pid 898] <... mount resumed>) = 0 [pid 898] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 898] chdir("./file1") = 0 [pid 898] ioctl(6, LOOP_CLR_FD) = 0 [pid 898] close(6) = 0 [pid 898] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 898] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 916 attached [pid 916] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 916] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 909] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 914] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 912] <... clone resumed>, parent_tid=[916], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 916 [pid 914] <... futex resumed>) = 1 [pid 912] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 911] <... futex resumed>) = 0 [pid 911] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 912] <... futex resumed>) = 1 [pid 911] <... futex resumed>) = 0 [pid 911] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 897] exit_group(0 [pid 899] <... futex resumed>) = ? [pid 898] <... futex resumed>) = ? [pid 897] <... exit_group resumed>) = ? [pid 899] +++ exited with 0 +++ [pid 898] +++ exited with 0 +++ [pid 897] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=897, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 297] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 914] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [ 31.731731][ T898] EXT4-fs (loop2): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 31.755669][ T898] ext4 filesystem being mounted at /root/syzkaller.7ngmbG/24/file1 supports timestamps until 2038 (0x7fffffff) [ 31.757793][ T913] loop5: detected capacity change from 0 to 512 [pid 912] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... openat resumed>) = 3 [pid 915] memfd_create("syzkaller", 0 [pid 916] <... futex resumed>) = 0 [pid 913] <... ioctl resumed>) = 0 [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 915] <... memfd_create resumed>) = 3 [pid 297] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./24/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] unlink("./24/bus") = 0 [pid 297] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 915] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 297] lstat("./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 915] <... mmap resumed>) = 0x7f35d66dd000 [pid 297] unlink("./24/binderfs") = 0 [pid 297] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 915] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 915] munmap(0x7f35d66dd000, 262144 [pid 916] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 915] <... munmap resumed>) = 0 [pid 913] close(3 [pid 912] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 911] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 916] <... open resumed>) = 4 [pid 915] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 913] <... close resumed>) = 0 [pid 912] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 916] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 915] <... openat resumed>) = 5 [pid 913] mkdir("./file1", 0777 [pid 912] <... futex resumed>) = 0 [ 31.777850][ T909] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 31.777850][ T909] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 31.777850][ T909] [ 31.779257][ T914] blk_update_request: I/O error, dev loop5, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 31.812102][ T904] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 31.812102][ T904] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 31.812102][ T904] [pid 916] <... futex resumed>) = 0 [pid 915] ioctl(5, LOOP_SET_FD, 3 [pid 913] <... mkdir resumed>) = 0 [pid 912] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 916] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 914] <... write resumed>) = -1 EIO (Input/output error) [pid 913] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 912] <... mmap resumed>) = 0x7f35d66fc000 [pid 914] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 912] mprotect(0x7f35d66fd000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 912] clone(child_stack=0x7f35d671c3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[919], tls=0x7f35d671c700, child_tidptr=0x7f35d671c9d0) = 919 ./strace-static-x86_64: Process 919 attached [pid 915] <... ioctl resumed>) = 0 [pid 914] <... futex resumed>) = 0 [pid 912] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 901] +++ exited with 0 +++ [pid 900] +++ exited with 0 +++ [pid 919] set_robust_list(0x7f35d671c9e0, 24 [pid 915] close(3 [pid 914] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 912] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=900, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 919] <... set_robust_list resumed>) = 0 [pid 919] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 919] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 912] <... futex resumed>) = 0 [pid 912] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 912] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 919] <... futex resumed>) = 1 [pid 919] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 915] <... close resumed>) = 0 [pid 915] mkdir("./file1", 0777 [pid 916] <... futex resumed>) = 0 [pid 916] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 3 [pid 916] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 916] <... futex resumed>) = 1 [pid 912] <... futex resumed>) = 0 [pid 295] <... restart_syscall resumed>) = 0 [pid 912] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [ 31.812578][ T914] Buffer I/O error on dev loop5, logical block 0, lost async page write [ 31.833549][ T915] loop1: detected capacity change from 0 to 512 [ 31.851368][ T913] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 31.851368][ T913] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 31.851368][ T913] [ 31.852304][ T909] EXT4-fs (loop3): 1 orphan inode deleted [pid 916] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 297] <... umount2 resumed>) = 0 [pid 295] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 916] <... write resumed>) = 262144 [pid 297] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 916] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] lstat("./24/file1", [pid 916] <... futex resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 297] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 916] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 915] <... mkdir resumed>) = 0 [pid 912] <... futex resumed>) = 0 [pid 297] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] fstat(3, [pid 913] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 913] ioctl(5, LOOP_CLR_FD) = 0 [pid 913] close(5 [pid 915] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 912] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 31.875837][ T913] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 31.888419][ T913] EXT4-fs (loop5): group descriptors corrupted! [ 31.891823][ T909] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/25/file1 supports timestamps until 2038 (0x7fffffff) [ 31.907704][ T30] audit: type=1400 audit(1688378253.451:75): avc: denied { remove_name } for pid=82 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [pid 912] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] getdents64(3, [pid 915] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 913] <... close resumed>) = 0 [pid 297] <... openat resumed>) = 4 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 915] ioctl(5, LOOP_CLR_FD [pid 913] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 909] <... mount resumed>) = 0 [pid 297] fstat(4, [pid 295] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 915] <... ioctl resumed>) = 0 [pid 913] <... futex resumed>) = 0 [pid 911] exit_group(0 [pid 297] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 915] close(5 [pid 911] <... exit_group resumed>) = ? [pid 297] getdents64(4, [pid 915] <... close resumed>) = 0 [pid 913] +++ exited with 0 +++ [pid 297] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 915] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] getdents64(4, [pid 915] <... futex resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 915] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] close(4) = 0 [pid 297] rmdir("./24/file1") = 0 [pid 912] exit_group(0 [pid 297] getdents64(3, [pid 916] <... futex resumed>) = ? [pid 915] <... futex resumed>) = ? [pid 912] <... exit_group resumed>) = ? [pid 297] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 916] +++ exited with 0 +++ [pid 915] +++ exited with 0 +++ [pid 297] close(3) = 0 [pid 297] rmdir("./24") = 0 [pid 297] mkdir("./25", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 922 [pid 909] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 909] chdir("./file1") = 0 [pid 909] ioctl(6, LOOP_CLR_FD) = 0 [pid 909] close(6) = 0 [pid 909] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 909] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 908] exit_group(0 [pid 910] <... futex resumed>) = ? [pid 908] <... exit_group resumed>) = ? [pid 910] +++ exited with 0 +++ [pid 909] <... futex resumed>) = ? [pid 295] <... umount2 resumed>) = 0 [pid 295] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./23/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] unlink("./23/bus") = 0 [pid 295] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] unlink("./23/binderfs") = 0 [pid 295] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] lstat("./23/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./23/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./23/file1") = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./23") = 0 [pid 295] mkdir("./24", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3 [pid 909] +++ exited with 0 +++ [pid 908] +++ exited with 0 +++ [pid 295] <... close resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=908, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 922 attached ./strace-static-x86_64: Process 923 attached [pid 919] <... futex resumed>) = ? [pid 914] <... futex resumed>) = ? [pid 904] <... mount resumed>) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 922] set_robust_list(0x555556c9c5e0, 24 [pid 919] +++ exited with 0 +++ [pid 912] +++ exited with 0 +++ [pid 923] set_robust_list(0x555556c9c5e0, 24 [pid 922] <... set_robust_list resumed>) = 0 [pid 904] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 298] <... restart_syscall resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=912, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 923 [pid 904] <... openat resumed>) = 3 [pid 923] <... set_robust_list resumed>) = 0 [pid 922] chdir("./25" [pid 904] chdir("./file1" [pid 923] chdir("./24" [pid 922] <... chdir resumed>) = 0 [pid 904] <... chdir resumed>) = 0 [pid 298] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 923] <... chdir resumed>) = 0 [pid 922] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 904] ioctl(6, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 923] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 922] <... prctl resumed>) = 0 [pid 904] <... ioctl resumed>) = 0 [pid 298] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 923] <... prctl resumed>) = 0 [pid 922] setpgid(0, 0 [pid 904] close(6 [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 923] setpgid(0, 0 [pid 922] <... setpgid resumed>) = 0 [pid 904] <... close resumed>) = 0 [pid 298] fstat(3, [pid 296] fstat(3, [pid 923] <... setpgid resumed>) = 0 [pid 922] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 904] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 902] exit_group(0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 923] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 922] <... openat resumed>) = 3 [pid 905] <... futex resumed>) = ? [pid 904] <... futex resumed>) = ? [pid 902] <... exit_group resumed>) = ? [pid 298] getdents64(3, [pid 296] getdents64(3, [pid 923] <... openat resumed>) = 3 [pid 922] write(3, "1000", 4 [pid 905] +++ exited with 0 +++ [pid 904] +++ exited with 0 +++ [pid 902] +++ exited with 0 +++ [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=902, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 296] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 923] write(3, "1000", 4 [pid 922] <... write resumed>) = 4 [pid 298] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 299] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 923] <... write resumed>) = 4 [pid 922] close(3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = 0 [pid 296] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 923] close(3 [pid 922] <... close resumed>) = 0 [pid 299] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 923] <... close resumed>) = 0 [pid 922] symlink("/dev/binderfs", "./binderfs" [pid 299] <... openat resumed>) = 3 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./23/bus", [pid 923] symlink("/dev/binderfs", "./binderfs" [pid 922] <... symlink resumed>) = 0 [pid 299] fstat(3, [pid 298] lstat("./25/bus", [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 922] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] unlink("./23/bus" [pid 922] <... futex resumed>) = 0 [pid 299] getdents64(3, [pid 298] unlink("./25/bus" [pid 296] <... unlink resumed>) = 0 [pid 922] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] <... unlink resumed>) = 0 [pid 296] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 923] <... symlink resumed>) = 0 [pid 922] <... mmap resumed>) = 0x7f35deafe000 [pid 923] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 923] <... futex resumed>) = 0 [pid 922] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 299] <... umount2 resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] lstat("./23/binderfs", [pid 923] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 922] <... mprotect resumed>) = 0 [pid 299] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] lstat("./25/binderfs", [pid 923] <... mmap resumed>) = 0x7f35deafe000 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 923] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 922] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] unlink("./23/binderfs" [pid 923] <... mprotect resumed>) = 0 [pid 299] lstat("./25/bus", [pid 298] unlink("./25/binderfs" [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] <... unlink resumed>) = 0 [pid 922] <... clone resumed>, parent_tid=[924], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 924 [pid 299] unlink("./25/bus" [pid 298] <... unlink resumed>) = 0 [pid 296] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 923] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 922] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... unlink resumed>) = 0 [pid 298] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 922] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] lstat("./25/binderfs", [pid 296] lstat("./23/file1", ./strace-static-x86_64: Process 924 attached [pid 299] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./25/binderfs" [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 924] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 296] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... unlink resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "./23/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 296] fstat(4, ./strace-static-x86_64: Process 925 attached [pid 922] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 925] set_robust_list(0x7f35deb1e9e0, 24 [pid 923] <... clone resumed>, parent_tid=[925], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 925 [pid 922] <... futex resumed>) = 0 [pid 925] <... set_robust_list resumed>) = 0 [pid 923] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 922] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] getdents64(4, [pid 923] <... futex resumed>) = 0 [pid 922] <... mmap resumed>) = 0x7f35deadd000 [pid 923] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 923] <... futex resumed>) = 0 [pid 922] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 296] getdents64(4, [pid 923] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 922] <... mprotect resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 925] memfd_create("syzkaller", 0 [pid 923] <... mmap resumed>) = 0x7f35deadd000 [pid 922] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 923] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 296] close(4 [pid 925] <... memfd_create resumed>) = 3 [pid 923] <... mprotect resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 923] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 925] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 922] <... clone resumed>, parent_tid=[926], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 926 [pid 296] rmdir("./23/file1" [pid 925] <... mmap resumed>) = 0x7f35d66dd000 [pid 922] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 924] memfd_create("syzkaller", 0 [pid 922] <... futex resumed>) = 0 [pid 923] <... clone resumed>, parent_tid=[927], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 927 [pid 296] <... rmdir resumed>) = 0 [pid 923] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 922] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(3, [pid 923] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 923] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] close(3) = 0 [pid 296] rmdir("./23" [pid 924] <... memfd_create resumed>) = 3 [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./24", 0777 [pid 924] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 296] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 924] <... mmap resumed>) = 0x7f35d66dd000 [pid 925] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 924] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 925] <... write resumed>) = 262144 [pid 925] munmap(0x7f35d66dd000, 262144 [pid 924] <... write resumed>) = 262144 [pid 924] munmap(0x7f35d66dd000, 262144 [pid 925] <... munmap resumed>) = 0 [pid 924] <... munmap resumed>) = 0 [pid 924] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 925] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 924] ioctl(4, LOOP_SET_FD, 3 [pid 925] <... openat resumed>) = 4 [ 31.909571][ T915] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 31.930780][ T904] EXT4-fs (loop4): 1 orphan inode deleted [ 31.936804][ T30] audit: type=1400 audit(1688378253.451:76): avc: denied { rename } for pid=82 comm="syslogd" name="messages" dev="tmpfs" ino=2 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 31.945533][ T904] ext4 filesystem being mounted at /root/syzkaller.RJEgPO/25/file1 supports timestamps until 2038 (0x7fffffff) ./strace-static-x86_64: Process 927 attached ./strace-static-x86_64: Process 926 attached [pid 925] ioctl(4, LOOP_SET_FD, 3 [pid 926] set_robust_list(0x7f35deafd9e0, 24 [pid 925] <... ioctl resumed>) = 0 [pid 924] <... ioctl resumed>) = 0 [pid 914] +++ exited with 0 +++ [pid 911] +++ exited with 0 +++ [pid 299] <... umount2 resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 926] <... set_robust_list resumed>) = 0 [pid 299] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 926] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=911, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 296] ioctl(3, LOOP_CLR_FD [pid 926] <... open resumed>) = 5 [pid 300] umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 926] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 926] <... futex resumed>) = 1 [pid 922] <... futex resumed>) = 0 [pid 300] openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] close(3 [pid 926] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 922] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... openat resumed>) = 3 [pid 926] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 922] <... futex resumed>) = 0 [pid 300] fstat(3, [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... close resumed>) = 0 [pid 926] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 922] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] lstat("./25/file1", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 926] <... mount resumed>) = 0 [pid 300] getdents64(3, [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] lstat("./25/file1", [pid 926] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 925] close(3 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 928 [pid 926] <... futex resumed>) = 1 [pid 925] <... close resumed>) = 0 [pid 922] <... futex resumed>) = 0 [pid 300] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 926] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 925] mkdir("./file1", 0777 [pid 922] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = 0 [pid 299] openat(AT_FDCWD, "./25/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 926] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 925] <... mkdir resumed>) = 0 [pid 924] close(3 [pid 922] <... futex resumed>) = 0 [pid 300] umount2("./22/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... openat resumed>) = 4 [pid 298] openat(AT_FDCWD, "./25/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 926] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 925] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 924] <... close resumed>) = 0 [pid 922] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] fstat(4, [pid 298] <... openat resumed>) = 4 ./strace-static-x86_64: Process 928 attached [pid 927] set_robust_list(0x7f35deafd9e0, 24 [pid 926] <... open resumed>) = 3 [pid 924] mkdir("./file1", 0777 [pid 300] lstat("./22/bus", [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] fstat(4, [pid 927] <... set_robust_list resumed>) = 0 [pid 926] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 924] <... mkdir resumed>) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] getdents64(4, [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 927] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 926] <... futex resumed>) = 1 [ 32.011824][ T924] loop2: detected capacity change from 0 to 512 [ 32.016672][ T925] loop0: detected capacity change from 0 to 512 [ 32.035670][ T925] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 32.035670][ T925] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.035670][ T925] [pid 924] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 923] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 922] <... futex resumed>) = 0 [pid 300] unlink("./22/bus" [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, [pid 928] set_robust_list(0x555556c9c5e0, 24 [pid 927] <... open resumed>) = 3 [pid 926] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 923] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 922] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... unlink resumed>) = 0 [pid 926] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 923] <... futex resumed>) = 0 [pid 922] <... futex resumed>) = 0 [pid 300] umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 926] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 923] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 922] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 928] <... set_robust_list resumed>) = 0 [pid 927] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 923] <... mmap resumed>) = 0x7f35d66fc000 [pid 300] lstat("./22/binderfs", [pid 299] getdents64(4, [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 923] mprotect(0x7f35d66fd000, 131072, PROT_READ|PROT_WRITE [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 923] <... mprotect resumed>) = 0 [pid 300] unlink("./22/binderfs" [pid 923] clone(child_stack=0x7f35d671c3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 300] <... unlink resumed>) = 0 [pid 300] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 923] <... clone resumed>, parent_tid=[931], tls=0x7f35d671c700, child_tidptr=0x7f35d671c9d0) = 931 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 923] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] lstat("./22/file1", [pid 923] <... futex resumed>) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 923] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] umount2("./22/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./22/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 300] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] close(4) = 0 [pid 300] rmdir("./22/file1") = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] close(3) = 0 [pid 300] rmdir("./22" [pid 928] chdir("./24" [pid 927] <... futex resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 298] getdents64(4, [pid 300] mkdir("./23", 0777 [pid 928] <... chdir resumed>) = 0 [pid 927] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] <... mkdir resumed>) = 0 [pid 299] close(4 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 299] <... close resumed>) = 0 [pid 928] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] close(4 [pid 928] <... prctl resumed>) = 0 [pid 300] ioctl(3, LOOP_CLR_FD [pid 299] rmdir("./25/file1" [pid 928] setpgid(0, 0 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... close resumed>) = 0 [pid 300] close(3 [pid 928] <... setpgid resumed>) = 0 [pid 926] <... write resumed>) = 262144 [pid 300] <... close resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 298] rmdir("./25/file1" [pid 926] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 926] <... futex resumed>) = 1 [pid 922] <... futex resumed>) = 0 [pid 926] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 932 ./strace-static-x86_64: Process 931 attached [pid 931] set_robust_list(0x7f35d671c9e0, 24) = 0 [pid 931] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 931] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 923] <... futex resumed>) = 0 [pid 931] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 923] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 923] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 932 attached [pid 932] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 932] chdir("./23") = 0 [pid 932] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 932] setpgid(0, 0 [pid 927] <... futex resumed>) = 0 [pid 932] <... setpgid resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 927] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 928] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 927] <... open resumed>) = 5 [pid 299] getdents64(3, [pid 298] getdents64(3, [pid 928] <... openat resumed>) = 3 [pid 927] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 932] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 928] write(3, "1000", 4 [pid 927] <... futex resumed>) = 1 [pid 923] <... futex resumed>) = 0 [pid 299] close(3 [pid 932] <... openat resumed>) = 3 [pid 923] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 932] write(3, "1000", 4 [pid 923] <... futex resumed>) = 0 [pid 932] <... write resumed>) = 4 [pid 923] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 932] close(3) = 0 [pid 932] symlink("/dev/binderfs", "./binderfs") = 0 [pid 932] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 932] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 932] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 932] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[933], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 933 [pid 932] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 932] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 932] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 932] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 932] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[934], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 934 [pid 932] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 932] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 933 attached [pid 933] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 933] memfd_create("syzkaller", 0./strace-static-x86_64: Process 934 attached [pid 934] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 934] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 933] <... memfd_create resumed>) = 3 [pid 933] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 934] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 932] <... futex resumed>) = 0 [pid 932] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 932] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 934] <... futex resumed>) = 1 [pid 934] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 934] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 932] <... futex resumed>) = 0 [pid 932] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 932] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 934] <... futex resumed>) = 1 [pid 928] <... write resumed>) = 4 [pid 927] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 299] <... close resumed>) = 0 [pid 298] close(3 [pid 934] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 928] close(3 [pid 927] <... write resumed>) = 262144 [pid 925] <... mount resumed>) = 0 [pid 299] rmdir("./25" [pid 298] <... close resumed>) = 0 [ 32.057361][ T924] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 32.057361][ T924] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.057361][ T924] [ 32.079137][ T925] EXT4-fs (loop0): 1 orphan inode deleted [ 32.095755][ T925] ext4 filesystem being mounted at /root/syzkaller.d28Auw/24/file1 supports timestamps until 2038 (0x7fffffff) [pid 934] <... open resumed>) = 5 [pid 933] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 928] <... close resumed>) = 0 [pid 927] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 925] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 299] <... rmdir resumed>) = 0 [pid 298] rmdir("./25" [pid 933] <... write resumed>) = 262144 [pid 925] <... openat resumed>) = 6 [pid 925] chdir("./file1") = 0 [pid 925] ioctl(4, LOOP_CLR_FD) = 0 [pid 925] close(4 [pid 934] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 933] munmap(0x7f35d66dd000, 262144 [pid 928] symlink("/dev/binderfs", "./binderfs" [pid 927] <... futex resumed>) = 1 [pid 925] <... close resumed>) = 0 [pid 924] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 923] <... futex resumed>) = 0 [pid 299] mkdir("./26", 0777 [pid 298] <... rmdir resumed>) = 0 [pid 934] <... futex resumed>) = 1 [pid 933] <... munmap resumed>) = 0 [pid 932] <... futex resumed>) = 0 [pid 928] <... symlink resumed>) = 0 [pid 927] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 925] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 924] ioctl(4, LOOP_CLR_FD [pid 299] <... mkdir resumed>) = 0 [pid 298] mkdir("./26", 0777 [pid 934] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 933] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 932] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 928] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 925] <... futex resumed>) = 0 [pid 924] <... ioctl resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 934] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 933] <... openat resumed>) = 6 [pid 932] <... futex resumed>) = 0 [pid 928] <... futex resumed>) = 0 [pid 924] close(4 [pid 299] <... openat resumed>) = 3 [pid 298] <... mkdir resumed>) = 0 [pid 934] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 933] ioctl(6, LOOP_SET_FD, 3 [pid 932] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 928] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 924] <... close resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 934] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 925] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 934] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 933] <... ioctl resumed>) = 0 [pid 928] <... mmap resumed>) = 0x7f35deafe000 [pid 924] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 923] exit_group(0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... openat resumed>) = 3 [pid 934] <... futex resumed>) = 1 [pid 933] close(3 [pid 932] <... futex resumed>) = 0 [pid 931] <... futex resumed>) = ? [pid 928] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 927] <... futex resumed>) = ? [pid 925] <... futex resumed>) = ? [pid 924] <... futex resumed>) = 0 [pid 923] <... exit_group resumed>) = ? [pid 299] close(3 [pid 298] ioctl(3, LOOP_CLR_FD [pid 934] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 933] <... close resumed>) = 0 [pid 931] +++ exited with 0 +++ [pid 928] <... mprotect resumed>) = 0 [pid 927] +++ exited with 0 +++ [pid 925] +++ exited with 0 +++ [pid 924] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 923] +++ exited with 0 +++ [pid 299] <... close resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 933] mkdir("./file1", 0777 [pid 928] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 922] exit_group(0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] close(3 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=923, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 933] <... mkdir resumed>) = 0 [pid 926] <... futex resumed>) = ? [pid 924] <... futex resumed>) = ? [pid 922] <... exit_group resumed>) = ? [pid 298] <... close resumed>) = 0 [pid 933] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 928] <... clone resumed>, parent_tid=[935], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 935 [pid 926] +++ exited with 0 +++ [pid 924] +++ exited with 0 +++ [pid 299] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 936 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 936 attached ./strace-static-x86_64: Process 935 attached [pid 936] set_robust_list(0x555556c9c5e0, 24 [pid 935] set_robust_list(0x7f35deb1e9e0, 24 [pid 936] <... set_robust_list resumed>) = 0 [pid 935] <... set_robust_list resumed>) = 0 [pid 936] chdir("./26" [pid 935] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 936] <... chdir resumed>) = 0 [pid 936] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 936] setpgid(0, 0) = 0 [pid 936] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 936] write(3, "1000", 4) = 4 [pid 936] close(3) = 0 [pid 936] symlink("/dev/binderfs", "./binderfs") = 0 [pid 936] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 936] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 936] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 936] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[937], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 937 [pid 936] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 936] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 936] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 936] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 936] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[938], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 938 [pid 936] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 936] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 937 attached [pid 937] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 937] memfd_create("syzkaller", 0) = 3 [pid 937] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 928] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 935] <... futex resumed>) = 0 ./strace-static-x86_64: Process 938 attached [pid 935] memfd_create("syzkaller", 0 [pid 928] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 939 [pid 295] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 935] <... memfd_create resumed>) = 3 [pid 928] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 938] set_robust_list(0x7f35deafd9e0, 24 [pid 935] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 928] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 938] <... set_robust_list resumed>) = 0 [pid 935] <... mmap resumed>) = 0x7f35d66fe000 [pid 928] <... mmap resumed>) = 0x7f35d66dd000 [pid 938] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 295] <... openat resumed>) = 3 [pid 937] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 935] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 928] mprotect(0x7f35d66de000, 131072, PROT_READ|PROT_WRITE [pid 938] <... open resumed>) = 4 [pid 938] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 928] <... mprotect resumed>) = 0 [pid 295] fstat(3, [pid 928] clone(child_stack=0x7f35d66fd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 938] <... futex resumed>) = 1 [pid 936] <... futex resumed>) = 0 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 938] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 936] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 935] <... write resumed>) = 262144 [pid 295] getdents64(3, [pid 938] <... mount resumed>) = 0 [pid 936] <... futex resumed>) = 0 [pid 938] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 936] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 935] munmap(0x7f35d66fe000, 262144 [pid 928] <... clone resumed>, parent_tid=[940], tls=0x7f35d66fd700, child_tidptr=0x7f35d66fd9d0) = 940 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 938] <... futex resumed>) = 0 [pid 936] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 928] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 938] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 936] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 935] <... munmap resumed>) = 0 [pid 928] <... futex resumed>) = 0 ./strace-static-x86_64: Process 940 attached ./strace-static-x86_64: Process 939 attached [pid 938] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 936] <... futex resumed>) = 0 [pid 935] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 928] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... umount2 resumed>) = 0 [pid 940] set_robust_list(0x7f35d66fd9e0, 24 [pid 938] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 936] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 935] <... openat resumed>) = 4 [pid 295] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 940] <... set_robust_list resumed>) = 0 [pid 938] <... open resumed>) = 5 [pid 935] ioctl(4, LOOP_SET_FD, 3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 939] set_robust_list(0x555556c9c5e0, 24 [pid 940] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 938] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 937] <... write resumed>) = 262144 [pid 937] munmap(0x7f35d66dd000, 262144) = 0 [pid 937] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 6 [ 32.110741][ T924] EXT4-fs (loop2): Magic mismatch, very weird! [ 32.120464][ T933] loop5: detected capacity change from 0 to 512 [ 32.131348][ T933] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 32.131348][ T933] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.131348][ T933] [ 32.155703][ T935] loop1: detected capacity change from 0 to 512 [pid 937] ioctl(6, LOOP_SET_FD, 3 [pid 940] <... open resumed>) = 5 [pid 939] <... set_robust_list resumed>) = 0 [pid 938] <... futex resumed>) = 1 [pid 936] <... futex resumed>) = 0 [pid 935] <... ioctl resumed>) = 0 [pid 295] lstat("./24/bus", [pid 938] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 936] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 938] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 936] <... futex resumed>) = 0 [pid 295] unlink("./24/bus" [pid 938] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 936] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... unlink resumed>) = 0 [pid 940] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 939] chdir("./26" [pid 937] <... ioctl resumed>) = 0 [pid 935] close(3 [pid 295] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 940] <... futex resumed>) = 1 [pid 939] <... chdir resumed>) = 0 [pid 937] close(3 [pid 935] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 940] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 939] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 937] <... close resumed>) = 0 [pid 935] mkdir("./file1", 0777 [pid 295] lstat("./24/binderfs", [pid 939] <... prctl resumed>) = 0 [pid 937] mkdir("./file1", 0777 [pid 935] <... mkdir resumed>) = 0 [pid 295] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 939] setpgid(0, 0 [pid 937] <... mkdir resumed>) = 0 [pid 935] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 295] unlink("./24/binderfs" [pid 939] <... setpgid resumed>) = 0 [pid 937] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 928] <... futex resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 928] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 940] <... futex resumed>) = 0 [pid 928] <... futex resumed>) = 1 [pid 940] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 928] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 940] <... mount resumed>) = 0 [pid 940] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 928] <... futex resumed>) = 0 [pid 940] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 928] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 940] <... open resumed>) = 3 [pid 928] <... futex resumed>) = 0 [pid 940] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 928] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 940] <... futex resumed>) = 0 [pid 928] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 940] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 928] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 928] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 939] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 940] <... write resumed>) = 262144 [pid 940] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 928] <... futex resumed>) = 0 [pid 940] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 938] <... write resumed>) = -1 EIO (Input/output error) [pid 938] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 938] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 936] <... futex resumed>) = 0 [pid 939] <... openat resumed>) = 3 [ 32.157432][ T937] loop4: detected capacity change from 0 to 512 [ 32.164578][ T938] blk_update_request: I/O error, dev loop4, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 32.172407][ T935] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 32.172407][ T935] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.172407][ T935] [ 32.183763][ T938] Buffer I/O error on dev loop4, logical block 0, lost async page write [ 32.201619][ T933] EXT4-fs (loop5): 1 orphan inode deleted [pid 939] write(3, "1000", 4) = 4 [pid 939] close(3) = 0 [pid 939] symlink("/dev/binderfs", "./binderfs") = 0 [pid 939] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 933] <... mount resumed>) = 0 [pid 922] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=922, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 933] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 935] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 933] <... openat resumed>) = 3 [ 32.213748][ T295] EXT4-fs error (device loop0): __ext4_get_inode_loc:4350: comm syz-executor252: Invalid inode table block 0 in block_group 0 [ 32.213812][ T933] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/23/file1 supports timestamps until 2038 (0x7fffffff) [ 32.227282][ T937] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 32.227282][ T937] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.227282][ T937] [ 32.239230][ T935] EXT4-fs (loop1): Magic mismatch, very weird! [pid 939] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 935] ioctl(4, LOOP_CLR_FD [pid 933] chdir("./file1" [pid 297] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 939] <... mmap resumed>) = 0x7f35deafe000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 939] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 297] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 939] <... mprotect resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 939] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 939] <... clone resumed>, parent_tid=[943], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 943 [pid 297] getdents64(3, [pid 939] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 939] <... futex resumed>) = 0 [pid 297] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 939] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 939] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 939] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 939] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[944], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 944 [pid 939] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 939] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 943 attached [pid 943] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 943] memfd_create("syzkaller", 0) = 3 [pid 943] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 ./strace-static-x86_64: Process 944 attached [pid 944] set_robust_list(0x7f35deafd9e0, 24 [pid 297] <... umount2 resumed>) = 0 [pid 297] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./25/bus", [pid 935] <... ioctl resumed>) = 0 [pid 933] <... chdir resumed>) = 0 [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] unlink("./25/bus") = 0 [pid 297] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 297] unlink("./25/binderfs") = 0 [pid 297] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./25/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./25/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./25/file1") = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./25") = 0 [pid 297] mkdir("./26", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 937] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 935] close(4 [pid 933] ioctl(6, LOOP_CLR_FD [pid 297] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 945 [pid 944] <... set_robust_list resumed>) = 0 [pid 944] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 4 [pid 944] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 939] <... futex resumed>) = 0 [pid 939] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 939] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 944] <... futex resumed>) = 1 [pid 944] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 944] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 939] <... futex resumed>) = 0 [pid 939] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 939] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 944] <... futex resumed>) = 1 [pid 944] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 944] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 939] <... futex resumed>) = 0 [pid 939] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 939] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 944] <... futex resumed>) = 1 [pid 944] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 943] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 944] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 944] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 939] <... futex resumed>) = 0 [pid 944] <... futex resumed>) = 1 [pid 944] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 943] <... write resumed>) = 262144 [pid 943] munmap(0x7f35d66dd000, 262144) = 0 [pid 943] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 6 [pid 943] ioctl(6, LOOP_SET_FD, 3./strace-static-x86_64: Process 945 attached [pid 937] ioctl(6, LOOP_CLR_FD [pid 935] <... close resumed>) = 0 [pid 933] <... ioctl resumed>) = 0 [pid 937] <... ioctl resumed>) = 0 [pid 935] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 933] close(6 [pid 928] exit_group(0 [pid 940] <... futex resumed>) = ? [pid 937] close(6 [pid 935] <... futex resumed>) = ? [pid 933] <... close resumed>) = 0 [pid 928] <... exit_group resumed>) = ? [pid 945] set_robust_list(0x555556c9c5e0, 24 [pid 943] <... ioctl resumed>) = 0 [pid 940] +++ exited with 0 +++ [pid 937] <... close resumed>) = 0 [pid 935] +++ exited with 0 +++ [pid 933] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 928] +++ exited with 0 +++ [pid 937] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 933] <... futex resumed>) = 0 [pid 932] exit_group(0 [pid 937] <... futex resumed>) = 0 [pid 934] <... futex resumed>) = ? [pid 932] <... exit_group resumed>) = ? [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=928, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 937] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 934] +++ exited with 0 +++ [pid 933] +++ exited with 0 +++ [pid 932] +++ exited with 0 +++ [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 936] exit_group(0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=932, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 296] <... restart_syscall resumed>) = 0 [pid 938] <... futex resumed>) = ? [pid 937] <... futex resumed>) = ? [pid 936] <... exit_group resumed>) = ? [pid 938] +++ exited with 0 +++ [pid 937] +++ exited with 0 +++ [pid 300] umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 936] +++ exited with 0 +++ [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=936, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 296] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 300] fstat(3, [pid 296] fstat(3, [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(3, [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] getdents64(3, [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 299] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... openat resumed>) = 3 [pid 296] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = 0 [pid 299] fstat(3, [pid 300] umount2("./23/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] getdents64(3, [pid 300] lstat("./23/bus", [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] unlink("./23/bus") = 0 [pid 299] <... umount2 resumed>) = 0 [pid 296] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] lstat("./23/binderfs", [pid 299] lstat("./26/bus", [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] lstat("./24/bus", [pid 300] unlink("./23/binderfs" [pid 299] unlink("./26/bus" [pid 300] <... unlink resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 300] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./24/bus" [pid 945] <... set_robust_list resumed>) = 0 [pid 943] close(3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] lstat("./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./26/binderfs" [pid 296] <... unlink resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 299] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 943] <... close resumed>) = 0 [pid 299] lstat("./26/file1", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] lstat("./24/binderfs", [pid 945] chdir("./26" [pid 943] mkdir("./file1", 0777 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 945] <... chdir resumed>) = 0 [pid 943] <... mkdir resumed>) = 0 [pid 299] openat(AT_FDCWD, "./26/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] <... openat resumed>) = 4 [pid 296] unlink("./24/binderfs" [pid 945] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 943] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [ 32.263151][ T295] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5830: Corrupt filesystem [ 32.265717][ T937] EXT4-fs (loop4): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 32.282464][ T937] EXT4-fs (loop4): group descriptors corrupted! [ 32.289099][ T295] EXT4-fs error (device loop0): ext4_quota_off:6461: inode #3: comm syz-executor252: mark_inode_dirty error [ 32.298513][ T943] loop3: detected capacity change from 0 to 512 [pid 299] fstat(4, [pid 945] <... prctl resumed>) = 0 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... unlink resumed>) = 0 [pid 299] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./26/file1") = 0 [pid 299] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./26") = 0 [pid 299] mkdir("./27", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 946 ./strace-static-x86_64: Process 946 attached [pid 946] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 946] chdir("./27") = 0 [pid 946] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 946] setpgid(0, 0) = 0 [pid 946] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 946] write(3, "1000", 4) = 4 [pid 946] close(3) = 0 [pid 946] symlink("/dev/binderfs", "./binderfs") = 0 [pid 946] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 946] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 946] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 946] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[947], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 947 [pid 946] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 296] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 946] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 945] setpgid(0, 0 [pid 296] lstat("./24/file1", [pid 945] <... setpgid resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 945] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 945] <... openat resumed>) = 3 [pid 945] write(3, "1000", 4 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 945] <... write resumed>) = 4 [pid 296] openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 945] close(3 [pid 946] <... futex resumed>) = 0 [pid 296] <... openat resumed>) = 4 [pid 945] <... close resumed>) = 0 [pid 296] fstat(4, [pid 945] symlink("/dev/binderfs", "./binderfs" [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 ./strace-static-x86_64: Process 947 attached [pid 946] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 945] <... symlink resumed>) = 0 [pid 296] getdents64(4, [pid 947] set_robust_list(0x7f35deb1e9e0, 24 [pid 946] <... mmap resumed>) = 0x7f35deadd000 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 947] <... set_robust_list resumed>) = 0 [pid 946] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 945] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] getdents64(4, [pid 947] memfd_create("syzkaller", 0 [pid 946] <... mprotect resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 947] <... memfd_create resumed>) = 3 [pid 946] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 296] close(4 [pid 947] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 296] <... close resumed>) = 0 [pid 947] <... mmap resumed>) = 0x7f35d66dd000 [pid 946] <... clone resumed>, parent_tid=[950], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 950 [pid 296] rmdir("./24/file1" [pid 947] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 946] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... rmdir resumed>) = 0 [pid 946] <... futex resumed>) = 0 [pid 296] getdents64(3, [pid 946] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./24") = 0 [pid 296] mkdir("./25", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 945] <... futex resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 951 [pid 947] <... write resumed>) = 262144 [pid 300] <... umount2 resumed>) = 0 [pid 945] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] lstat("./23/file1", [pid 947] munmap(0x7f35d66dd000, 262144 [pid 945] <... mmap resumed>) = 0x7f35deafe000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] lstat("./24/file1", [pid 945] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 300] umount2("./23/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 947] <... munmap resumed>) = 0 [pid 945] <... mprotect resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 947] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 945] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 300] openat(AT_FDCWD, "./23/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... openat resumed>) = 4 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 945] <... clone resumed>, parent_tid=[952], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 952 [pid 300] fstat(4, [pid 947] <... openat resumed>) = 4 [pid 295] openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 947] ioctl(4, LOOP_SET_FD, 3 [pid 945] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... openat resumed>) = 4 [pid 300] getdents64(4, [pid 295] fstat(4, [pid 945] <... futex resumed>) = 0 [pid 945] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [ 32.331317][ T943] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 32.331317][ T943] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.331317][ T943] [ 32.357474][ T943] EXT4-fs (loop3): 1 orphan inode deleted [ 32.363142][ T943] ext4 filesystem being mounted at /root/syzkaller.aTUVIK/26/file1 supports timestamps until 2038 (0x7fffffff) [pid 943] <... mount resumed>) = 0 [pid 943] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 943] chdir("./file1") = 0 [pid 943] ioctl(6, LOOP_CLR_FD) = 0 [pid 943] close(6) = 0 [pid 943] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 943] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 950 attached [pid 939] exit_group(0) = ? [pid 300] getdents64(4, [pid 944] <... futex resumed>) = ? [pid 944] +++ exited with 0 +++ [pid 300] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 943] <... futex resumed>) = ? [pid 943] +++ exited with 0 +++ [pid 939] +++ exited with 0 +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=939, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 298] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 298] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] close(4 [pid 298] getdents64(3, [pid 295] getdents64(4, [pid 945] <... futex resumed>) = 0 [pid 945] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 945] <... mmap resumed>) = 0x7f35deadd000 [pid 300] rmdir("./23/file1" [pid 298] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 945] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 300] <... rmdir resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 295] getdents64(4, [pid 298] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./26/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] unlink("./26/bus") = 0 [pid 298] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] lstat("./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] unlink("./26/binderfs" [pid 945] <... mprotect resumed>) = 0 [pid 300] getdents64(3, [pid 298] <... unlink resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 945] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 300] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 298] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] close(3 [pid 295] close(4 [pid 950] set_robust_list(0x7f35deafd9e0, 24 [pid 300] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 300] rmdir("./23" [pid 295] rmdir("./24/file1" [pid 950] <... set_robust_list resumed>) = 0 [pid 950] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 300] <... rmdir resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 300] mkdir("./24", 0777 [pid 295] getdents64(3, [pid 950] <... open resumed>) = 5 [pid 300] <... mkdir resumed>) = 0 [pid 945] <... clone resumed>, parent_tid=[953], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 953 [pid 295] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 295] close(3 [pid 945] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... openat resumed>) = 3 [pid 945] <... futex resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 945] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] ioctl(3, LOOP_CLR_FD [pid 295] rmdir("./24" [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 950] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... rmdir resumed>) = 0 [pid 300] close(3 [pid 946] <... futex resumed>) = 0 [pid 946] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] <... close resumed>) = 0 [pid 295] mkdir("./25", 0777 [pid 946] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... mkdir resumed>) = 0 [pid 950] <... futex resumed>) = 1 [pid 950] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 300] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 954 [pid 295] <... openat resumed>) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 950] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 946] <... futex resumed>) = 0 [pid 946] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 946] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... clone resumed>, child_tidptr=0x555556c9c5d0) = 955 [pid 950] <... futex resumed>) = 1 [pid 950] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c./strace-static-x86_64: Process 954 attached [pid 954] set_robust_list(0x555556c9c5e0, 24./strace-static-x86_64: Process 955 attached [pid 955] set_robust_list(0x555556c9c5e0, 24 [pid 954] <... set_robust_list resumed>) = 0 [pid 954] chdir("./24" [pid 955] <... set_robust_list resumed>) = 0 [pid 955] chdir("./25" [pid 954] <... chdir resumed>) = 0 [pid 955] <... chdir resumed>) = 0 [pid 954] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 955] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 954] setpgid(0, 0 [pid 955] <... prctl resumed>) = 0 [pid 955] setpgid(0, 0 [pid 954] <... setpgid resumed>) = 0 ./strace-static-x86_64: Process 953 attached ./strace-static-x86_64: Process 952 attached [pid 953] set_robust_list(0x7f35deafd9e0, 24 [pid 952] set_robust_list(0x7f35deb1e9e0, 24 [pid 953] <... set_robust_list resumed>) = 0 [pid 952] <... set_robust_list resumed>) = 0 [pid 955] <... setpgid resumed>) = 0 [pid 954] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 955] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 954] <... openat resumed>) = 3 [pid 955] write(3, "1000", 4 [pid 953] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 952] memfd_create("syzkaller", 0 [pid 955] <... write resumed>) = 4 [pid 954] write(3, "1000", 4 [pid 955] close(3 [pid 954] <... write resumed>) = 4 [pid 955] <... close resumed>) = 0 [pid 954] close(3 [pid 952] <... memfd_create resumed>) = 4 ./strace-static-x86_64: Process 951 attached [pid 953] <... open resumed>) = 3 [pid 955] symlink("/dev/binderfs", "./binderfs" [pid 954] <... close resumed>) = 0 [pid 952] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 950] <... open resumed>) = 6 [pid 947] <... ioctl resumed>) = 0 [pid 955] <... symlink resumed>) = 0 [pid 954] symlink("/dev/binderfs", "./binderfs" [pid 953] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 952] <... mmap resumed>) = 0x7f35d66dd000 [pid 951] set_robust_list(0x555556c9c5e0, 24 [pid 950] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 947] close(3 [pid 955] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] <... symlink resumed>) = 0 [pid 950] <... futex resumed>) = 1 [pid 946] <... futex resumed>) = 0 [pid 955] <... futex resumed>) = 0 [pid 954] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 953] <... futex resumed>) = 1 [pid 950] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 946] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 945] <... futex resumed>) = 0 [pid 955] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 954] <... futex resumed>) = 0 [pid 953] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 950] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 946] <... futex resumed>) = 0 [pid 945] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 955] <... mmap resumed>) = 0x7f35deafe000 [pid 954] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 951] <... set_robust_list resumed>) = 0 [pid 950] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 946] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 953] <... mount resumed>) = 0 [pid 952] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 951] chdir("./25" [pid 947] <... close resumed>) = 0 [pid 945] <... futex resumed>) = 0 [pid 953] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 952] <... write resumed>) = 262144 [pid 951] <... chdir resumed>) = 0 [pid 947] mkdir("./file1", 0777 [pid 945] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 953] <... futex resumed>) = 0 [pid 951] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 947] <... mkdir resumed>) = 0 [pid 945] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 953] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 951] <... prctl resumed>) = 0 [pid 947] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 945] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 955] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 954] <... mmap resumed>) = 0x7f35deafe000 [pid 953] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 952] munmap(0x7f35d66dd000, 262144 [pid 951] setpgid(0, 0 [pid 945] <... futex resumed>) = 0 [pid 953] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 952] <... munmap resumed>) = 0 [pid 951] <... setpgid resumed>) = 0 [pid 945] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 953] <... open resumed>) = 5 [pid 952] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 951] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 955] <... mprotect resumed>) = 0 [pid 954] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 953] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 951] <... openat resumed>) = 3 [pid 950] <... write resumed>) = 262144 [ 32.380471][ T947] loop4: detected capacity change from 0 to 512 [pid 955] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 954] <... mprotect resumed>) = 0 [pid 953] <... futex resumed>) = 1 [pid 951] write(3, "1000", 4 [pid 950] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 945] <... futex resumed>) = 0 [pid 953] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 952] <... openat resumed>) = 6 [pid 945] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 951] <... write resumed>) = 4 [pid 954] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 953] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 952] ioctl(6, LOOP_SET_FD, 4 [pid 951] close(3 [pid 950] <... futex resumed>) = 1 [pid 946] <... futex resumed>) = 0 [pid 945] <... futex resumed>) = 0 ./strace-static-x86_64: Process 956 attached [pid 955] <... clone resumed>, parent_tid=[956], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 956 [pid 953] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 951] <... close resumed>) = 0 [pid 950] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 947] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 956] set_robust_list(0x7f35deb1e9e0, 24 [pid 955] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] <... clone resumed>, parent_tid=[957], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 957 [pid 947] ioctl(4, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = 0 [pid 956] <... set_robust_list resumed>) = 0 [pid 955] <... futex resumed>) = 0 [pid 954] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 947] <... ioctl resumed>) = 0 [pid 298] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 956] memfd_create("syzkaller", 0 [pid 955] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] <... futex resumed>) = 0 [pid 947] close(4 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 956] <... memfd_create resumed>) = 3 [pid 955] <... futex resumed>) = 0 [pid 954] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 947] <... close resumed>) = 0 [pid 298] lstat("./26/file1", [pid 956] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 955] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 954] <... futex resumed>) = 0 [pid 947] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 956] <... mmap resumed>) = 0x7f35d66fe000 [pid 955] <... mmap resumed>) = 0x7f35d66dd000 [pid 954] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 947] <... futex resumed>) = 0 [pid 945] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 956] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 955] mprotect(0x7f35d66de000, 131072, PROT_READ|PROT_WRITE [pid 954] <... mmap resumed>) = 0x7f35deadd000 [pid 947] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 946] exit_group(0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 956] <... write resumed>) = 262144 [pid 955] <... mprotect resumed>) = 0 [pid 954] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 950] <... futex resumed>) = ? [pid 947] <... futex resumed>) = ? [pid 946] <... exit_group resumed>) = ? [pid 298] openat(AT_FDCWD, "./26/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 956] munmap(0x7f35d66fe000, 262144 [pid 955] clone(child_stack=0x7f35d66fd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 954] <... mprotect resumed>) = 0 [pid 951] symlink("/dev/binderfs", "./binderfs" [pid 950] +++ exited with 0 +++ [pid 947] +++ exited with 0 +++ [pid 298] <... openat resumed>) = 4 [pid 956] <... munmap resumed>) = 0 [pid 954] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 951] <... symlink resumed>) = 0 [pid 298] fstat(4, [pid 956] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 955] <... clone resumed>, parent_tid=[959], tls=0x7f35d66fd700, child_tidptr=0x7f35d66fd9d0) = 959 [pid 951] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 ./strace-static-x86_64: Process 957 attached [pid 956] <... openat resumed>) = 4 [pid 955] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] <... clone resumed>, parent_tid=[960], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 960 [pid 951] <... futex resumed>) = 0 [pid 298] getdents64(4, [pid 957] set_robust_list(0x7f35deb1e9e0, 24 [pid 956] ioctl(4, LOOP_SET_FD, 3 [pid 955] <... futex resumed>) = 0 [pid 954] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 951] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 957] <... set_robust_list resumed>) = 0 [pid 955] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 954] <... futex resumed>) = 0 [pid 951] <... mmap resumed>) = 0x7f35deafe000 [pid 298] getdents64(4, [pid 954] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 951] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 951] <... mprotect resumed>) = 0 [pid 298] close(4 [pid 951] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] <... close resumed>) = 0 [pid 298] rmdir("./26/file1" [pid 951] <... clone resumed>, parent_tid=[961], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 961 [pid 298] <... rmdir resumed>) = 0 [pid 951] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 951] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 951] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 951] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 951] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] rmdir("./26" [pid 951] <... mmap resumed>) = 0x7f35deadd000 [pid 298] <... rmdir resumed>) = 0 [pid 951] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE [pid 298] mkdir("./27", 0777./strace-static-x86_64: Process 960 attached [pid 951] <... mprotect resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 960] set_robust_list(0x7f35deafd9e0, 24 [pid 951] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 960] <... set_robust_list resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 951] <... clone resumed>, parent_tid=[962], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 962 [pid 298] ioctl(3, LOOP_CLR_FD [pid 951] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 951] <... futex resumed>) = 0 [pid 298] close(3 [pid 951] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... close resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 963 [pid 960] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000./strace-static-x86_64: Process 959 attached ) = 3 [pid 960] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 959] set_robust_list(0x7f35d66fd9e0, 24 [pid 960] <... futex resumed>) = 1 [pid 959] <... set_robust_list resumed>) = 0 [pid 954] <... futex resumed>) = 0 ./strace-static-x86_64: Process 961 attached ./strace-static-x86_64: Process 963 attached [pid 960] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 959] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 957] memfd_create("syzkaller", 0 [pid 956] <... ioctl resumed>) = 0 [pid 954] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 952] <... ioctl resumed>) = 0 [pid 961] set_robust_list(0x7f35deb1e9e0, 24 [pid 960] <... mount resumed>) = 0 [pid 959] <... open resumed>) = 5 [pid 957] <... memfd_create resumed>) = 4 [pid 956] close(3 [pid 954] <... futex resumed>) = 0 [pid 952] close(4 [pid 963] set_robust_list(0x555556c9c5e0, 24 [pid 961] <... set_robust_list resumed>) = 0 [pid 960] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 959] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 957] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 956] <... close resumed>) = 0 [pid 954] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 952] <... close resumed>) = 0 ./strace-static-x86_64: Process 962 attached [pid 963] <... set_robust_list resumed>) = 0 [pid 961] memfd_create("syzkaller", 0 [pid 960] <... futex resumed>) = 0 [pid 959] <... futex resumed>) = 1 [pid 957] <... mmap resumed>) = 0x7f35d66dd000 [pid 956] mkdir("./file1", 0777 [pid 955] <... futex resumed>) = 0 [pid 954] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 952] mkdir("./file1", 0777 [pid 963] chdir("./27" [pid 962] set_robust_list(0x7f35deafd9e0, 24 [pid 961] <... memfd_create resumed>) = 3 [pid 960] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 959] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 956] <... mkdir resumed>) = 0 [pid 955] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 962] <... set_robust_list resumed>) = 0 [pid 960] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 959] <... mount resumed>) = 0 [pid 956] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 955] <... futex resumed>) = 0 [ 32.418156][ T947] EXT4-fs (loop4): VFS: Can't find ext4 filesystem [ 32.418456][ T952] loop2: detected capacity change from 0 to 512 [ 32.435707][ T953] blk_update_request: I/O error, dev loop2, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 32.451056][ T956] loop0: detected capacity change from 0 to 512 [ 32.451229][ T953] Buffer I/O error on dev loop2, logical block 0, lost async page write [pid 954] <... futex resumed>) = 0 [pid 963] <... chdir resumed>) = 0 [pid 962] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 961] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 960] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 959] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 957] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 955] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 953] <... write resumed>) = -1 EIO (Input/output error) [pid 952] <... mkdir resumed>) = 0 [pid 963] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 961] <... mmap resumed>) = 0x7f35d66dd000 [pid 957] <... write resumed>) = 262144 [pid 953] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 952] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 963] <... prctl resumed>) = 0 [pid 961] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 957] munmap(0x7f35d66dd000, 262144 [pid 953] <... futex resumed>) = 1 [pid 945] <... futex resumed>) = 0 [pid 963] setpgid(0, 0 [pid 962] <... open resumed>) = 4 [pid 961] <... write resumed>) = 262144 [pid 960] <... open resumed>) = 5 [pid 959] <... futex resumed>) = 0 [pid 957] <... munmap resumed>) = 0 [pid 955] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 954] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 963] <... setpgid resumed>) = 0 [pid 962] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 961] munmap(0x7f35d66dd000, 262144 [pid 960] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 959] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 957] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 955] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 953] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 963] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 962] <... futex resumed>) = 1 [pid 961] <... munmap resumed>) = 0 [pid 960] <... futex resumed>) = 0 [pid 959] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 955] <... futex resumed>) = 0 [pid 954] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 951] <... futex resumed>) = 0 [pid 962] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 960] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 959] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 955] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 954] <... futex resumed>) = 0 [pid 951] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 962] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 960] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 959] <... open resumed>) = 3 [pid 954] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 951] <... futex resumed>) = 0 [pid 962] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 960] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 959] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 954] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 951] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 962] <... mount resumed>) = 0 [pid 960] <... futex resumed>) = 0 [pid 959] <... futex resumed>) = 1 [pid 955] <... futex resumed>) = 0 [pid 962] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 960] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 959] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 955] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 946] +++ exited with 0 +++ [pid 962] <... futex resumed>) = 1 [pid 959] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 955] <... futex resumed>) = 0 [pid 951] <... futex resumed>) = 0 [pid 962] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 959] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 955] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 951] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=946, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 962] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 959] <... write resumed>) = 262144 [pid 951] <... futex resumed>) = 0 [pid 299] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW [pid 962] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 959] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 951] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 962] <... open resumed>) = 5 [pid 959] <... futex resumed>) = 1 [pid 955] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 962] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 959] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... openat resumed>) = 3 [pid 962] <... futex resumed>) = 1 [pid 951] <... futex resumed>) = 0 [pid 299] fstat(3, [pid 962] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 951] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 962] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 951] <... futex resumed>) = 0 [pid 299] getdents64(3, [pid 962] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 951] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 962] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 299] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 962] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 951] <... futex resumed>) = 0 [pid 962] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 957] <... openat resumed>) = 6 [pid 957] ioctl(6, LOOP_SET_FD, 4 [pid 963] <... openat resumed>) = 3 [pid 299] <... umount2 resumed>) = 0 [pid 299] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./27/bus", {st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 299] unlink("./27/bus") = 0 [pid 299] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 299] unlink("./27/binderfs") = 0 [pid 299] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] lstat("./27/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 299] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 957] <... ioctl resumed>) = 0 [pid 299] openat(AT_FDCWD, "./27/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 957] close(4 [pid 299] <... openat resumed>) = 4 [pid 957] <... close resumed>) = 0 [ 32.470095][ T956] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [ 32.470095][ T956] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.470095][ T956] [ 32.491772][ T952] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 32.491772][ T952] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.491772][ T952] [ 32.508362][ T957] loop5: detected capacity change from 0 to 512 [pid 299] fstat(4, [pid 957] mkdir("./file1", 0777 [pid 299] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 957] <... mkdir resumed>) = 0 [pid 299] getdents64(4, [pid 957] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 299] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 963] write(3, "1000", 4 [pid 961] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 956] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] getdents64(4, [pid 963] <... write resumed>) = 4 [pid 961] <... openat resumed>) = 6 [pid 956] ioctl(4, LOOP_CLR_FD [pid 299] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 963] close(3 [pid 961] ioctl(6, LOOP_SET_FD, 3 [pid 956] <... ioctl resumed>) = 0 [pid 963] <... close resumed>) = 0 [pid 956] close(4 [pid 299] close(4 [pid 963] symlink("/dev/binderfs", "./binderfs" [pid 961] <... ioctl resumed>) = 0 [pid 956] <... close resumed>) = 0 [pid 963] <... symlink resumed>) = 0 [pid 961] close(3 [pid 956] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 963] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 961] <... close resumed>) = 0 [pid 956] <... futex resumed>) = 0 [pid 963] <... futex resumed>) = 0 [pid 961] mkdir("./file1", 0777 [pid 956] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 963] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 961] <... mkdir resumed>) = 0 [pid 963] <... mmap resumed>) = 0x7f35deafe000 [pid 963] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 961] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 963] <... mprotect resumed>) = 0 [pid 963] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 955] exit_group(0 [pid 952] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] <... close resumed>) = 0 [pid 959] <... futex resumed>) = ? [pid 955] <... exit_group resumed>) = ? [pid 952] ioctl(6, LOOP_CLR_FD [pid 299] rmdir("./27/file1" [pid 959] +++ exited with 0 +++ [pid 952] <... ioctl resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 952] close(6 [pid 299] getdents64(3, [pid 952] <... close resumed>) = 0 [ 32.516895][ T956] EXT4-fs warning (device loop0): read_mmp_block:115: Error -117 while reading MMP block 8 [ 32.522328][ T957] EXT4-fs (loop5): Mount option "nouser_xattr" will be removed by 3.5 [ 32.522328][ T957] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.522328][ T957] [ 32.545730][ T952] EXT4-fs (loop2): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 32.555938][ T961] loop1: detected capacity change from 0 to 512 [ 32.556492][ T952] EXT4-fs (loop2): group descriptors corrupted! [pid 299] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 952] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(3 [pid 952] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 952] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] rmdir("./27") = 0 [pid 299] mkdir("./28", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 966 [pid 963] <... clone resumed>, parent_tid=[967], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 967 [pid 963] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 963] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 963] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 963] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 963] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[968], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 968 [pid 963] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 963] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 967 attached [pid 967] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 967] memfd_create("syzkaller", 0) = 3 [pid 967] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 967] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 967] munmap(0x7f35d66dd000, 262144) = 0 [pid 967] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 967] ioctl(4, LOOP_SET_FD, 3 [pid 956] <... futex resumed>) = ? [pid 967] <... ioctl resumed>) = 0 [pid 967] close(3) = 0 [pid 967] mkdir("./file1", 0777) = 0 [pid 967] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 945] exit_group(0) = ? [pid 953] <... futex resumed>) = ? [pid 952] <... futex resumed>) = ? [pid 952] +++ exited with 0 +++ ./strace-static-x86_64: Process 966 attached [pid 966] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 966] chdir("./28") = 0 [pid 966] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 966] setpgid(0, 0) = 0 [pid 966] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 966] write(3, "1000", 4) = 4 [pid 966] close(3) = 0 [pid 966] symlink("/dev/binderfs", "./binderfs") = 0 [pid 966] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 966] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 966] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 966] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[969], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 969 [pid 966] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 966] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 966] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 966] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 966] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[970], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 970 [pid 966] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 966] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 969 attached [pid 969] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 969] memfd_create("syzkaller", 0) = 3 [pid 969] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 969] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 969] munmap(0x7f35d66dd000, 262144) = 0 [pid 969] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 969] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 969] close(3) = 0 [pid 969] mkdir("./file1", 0777) = 0 [ 32.568747][ T961] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 32.568747][ T961] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.568747][ T961] [ 32.584247][ T967] loop3: detected capacity change from 0 to 512 [ 32.589760][ T957] EXT4-fs (loop5): 1 orphan inode deleted [ 32.601128][ T967] EXT4-fs (loop3): Mount option "nouser_xattr" will be removed by 3.5 [ 32.601128][ T967] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.601128][ T967] [pid 969] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"..../strace-static-x86_64: Process 968 attached [pid 968] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 968] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 968] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 963] <... futex resumed>) = 0 [pid 963] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 963] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 968] <... futex resumed>) = 1 [pid 968] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 968] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 963] <... futex resumed>) = 0 [pid 963] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 963] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 968] <... futex resumed>) = 1 [pid 968] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5 [pid 968] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 963] <... futex resumed>) = 0 [pid 963] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 963] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 968] <... futex resumed>) = 1 [ 32.619204][ T969] loop4: detected capacity change from 0 to 512 [ 32.626298][ T969] EXT4-fs (loop4): Mount option "nouser_xattr" will be removed by 3.5 [ 32.626298][ T969] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.626298][ T969] [ 32.632693][ T957] EXT4-fs mount: 5 callbacks suppressed [pid 968] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651./strace-static-x86_64: Process 970 attached ) = 262144 [pid 956] +++ exited with 0 +++ [pid 955] +++ exited with 0 +++ [pid 953] +++ exited with 0 +++ [pid 945] +++ exited with 0 +++ [pid 970] set_robust_list(0x7f35deafd9e0, 24 [pid 968] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=955, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 970] <... set_robust_list resumed>) = 0 [pid 968] <... futex resumed>) = 1 [pid 970] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 968] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 963] <... futex resumed>) = 0 [pid 970] <... open resumed>) = 3 [pid 966] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=945, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 966] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 966] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW [pid 966] <... mmap resumed>) = 0x7f35d66fc000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 966] mprotect(0x7f35d66fd000, 131072, PROT_READ|PROT_WRITE [pid 297] openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 966] <... mprotect resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 966] clone(child_stack=0x7f35d671c3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 297] fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 966] <... clone resumed>, parent_tid=[971], tls=0x7f35d671c700, child_tidptr=0x7f35d671c9d0) = 971 [pid 297] getdents64(3, [pid 966] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 966] <... futex resumed>) = 0 [pid 297] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 966] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 970] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 970] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./26/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... openat resumed>) = 3 [pid 297] lstat("./26/bus", [pid 295] fstat(3, [pid 297] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 295] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(3, [pid 297] unlink("./26/bus" [pid 295] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 297] <... unlink resumed>) = 0 [pid 295] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] lstat("./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 295] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 971 attached [pid 297] unlink("./26/binderfs" [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... unlink resumed>) = 0 [pid 295] lstat("./25/bus", [pid 297] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] lstat("./26/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 297] umount2("./26/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] unlink("./25/bus" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./26/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... unlink resumed>) = 0 [pid 297] <... openat resumed>) = 4 [pid 297] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./26/file1") = 0 [pid 297] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./26") = 0 [pid 297] mkdir("./27", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 974 ./strace-static-x86_64: Process 974 attached [pid 974] set_robust_list(0x555556c9c5e0, 24) = 0 [pid 974] chdir("./27") = 0 [pid 974] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 974] setpgid(0, 0) = 0 [pid 974] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 974] write(3, "1000", 4) = 4 [pid 974] close(3) = 0 [pid 974] symlink("/dev/binderfs", "./binderfs") = 0 [pid 974] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 974] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deafe000 [pid 974] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 974] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[975], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 975 [pid 974] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 974] <... futex resumed>) = 0 [pid 974] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 974] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35deadd000 [pid 974] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 974] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[976], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 976 [pid 974] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 295] lstat("./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 971] set_robust_list(0x7f35d671c9e0, 24 [pid 295] unlink("./25/binderfs" [pid 974] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 976 attached [pid 976] set_robust_list(0x7f35deafd9e0, 24) = 0 [pid 976] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000) = 3 [pid 976] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 974] <... futex resumed>) = 0 [pid 974] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 974] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 976] <... futex resumed>) = 1 [pid 976] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 976] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 974] <... futex resumed>) = 0 [pid 974] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 974] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 976] <... futex resumed>) = 1 [pid 976] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 4 [pid 976] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 974] <... futex resumed>) = 0 [pid 974] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 974] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 976] <... futex resumed>) = 1 [pid 976] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = -1 ENOSPC (No space left on device) [pid 976] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 974] <... futex resumed>) = 0 [pid 976] <... futex resumed>) = 1 [pid 976] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 975 attached [pid 975] set_robust_list(0x7f35deb1e9e0, 24) = 0 [pid 975] memfd_create("syzkaller", 0) = 5 [pid 975] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [pid 975] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 975] munmap(0x7f35d66dd000, 262144) = 0 [pid 975] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 6 [ 32.632707][ T957] EXT4-fs (loop5): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 32.674468][ T967] EXT4-fs (loop3): Magic mismatch, very weird! [ 32.679206][ T957] ext4 filesystem being mounted at /root/syzkaller.hTfQVQ/24/file1 supports timestamps until 2038 (0x7fffffff) [ 32.697926][ T961] EXT4-fs (loop1): 1 orphan inode deleted [pid 975] ioctl(6, LOOP_SET_FD, 5 [pid 966] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 966] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... unlink resumed>) = 0 [pid 970] <... futex resumed>) = 0 [pid 966] <... futex resumed>) = 1 [pid 295] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 970] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 966] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 970] <... open resumed>) = 5 [pid 295] lstat("./25/file1", [pid 970] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 970] <... futex resumed>) = 1 [pid 966] <... futex resumed>) = 0 [pid 295] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 970] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x65\x78\x74\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651 [pid 966] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 966] <... futex resumed>) = 0 [pid 295] openat(AT_FDCWD, "./25/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 966] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... openat resumed>) = 4 [pid 295] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 295] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./25/file1") = 0 [pid 295] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./25") = 0 [pid 295] mkdir("./26", 0777 [pid 961] <... mount resumed>) = 0 [pid 957] <... mount resumed>) = 0 [pid 975] <... ioctl resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 971] <... set_robust_list resumed>) = 0 [pid 961] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 957] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 975] close(5 [pid 971] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 975] <... close resumed>) = 0 [pid 961] <... openat resumed>) = 3 [pid 957] <... openat resumed>) = 4 [pid 975] mkdir("./file1", 0777 [pid 961] chdir("./file1" [pid 957] chdir("./file1" [pid 967] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 975] <... mkdir resumed>) = 0 [pid 967] ioctl(4, LOOP_CLR_FD [pid 961] <... chdir resumed>) = 0 [pid 957] <... chdir resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 975] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"... [pid 967] <... ioctl resumed>) = 0 [pid 961] ioctl(6, LOOP_CLR_FD [pid 957] ioctl(6, LOOP_CLR_FD [pid 295] ioctl(3, LOOP_CLR_FD [pid 967] close(4 [pid 961] <... ioctl resumed>) = 0 [pid 957] <... ioctl resumed>) = 0 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 977 [pid 967] <... close resumed>) = 0 [pid 961] close(6 [pid 957] close(6 [pid 967] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 963] exit_group(0 [pid 961] <... close resumed>) = 0 [pid 957] <... close resumed>) = 0 [pid 968] <... futex resumed>) = ? [pid 967] <... futex resumed>) = ? [pid 963] <... exit_group resumed>) = ? [pid 961] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 957] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 968] +++ exited with 0 +++ [pid 967] +++ exited with 0 +++ [pid 963] +++ exited with 0 +++ [pid 961] <... futex resumed>) = 0 [pid 957] <... futex resumed>) = 0 [pid 961] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 957] futex(0x7f35debf77a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 954] exit_group(0 [pid 951] exit_group(0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=963, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 962] <... futex resumed>) = ? [pid 961] <... futex resumed>) = ? [ 32.709813][ T961] EXT4-fs (loop1): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 32.719700][ T975] loop2: detected capacity change from 0 to 512 [ 32.733223][ T961] ext4 filesystem being mounted at /root/syzkaller.5s3MMz/25/file1 supports timestamps until 2038 (0x7fffffff) [ 32.754305][ T975] EXT4-fs (loop2): Mount option "nouser_xattr" will be removed by 3.5 [ 32.754305][ T975] Contact linux-ext4@vger.kernel.org if you think we should keep it. [pid 960] <... futex resumed>) = ? [pid 957] <... futex resumed>) = ? [pid 954] <... exit_group resumed>) = ? [pid 951] <... exit_group resumed>) = ? [pid 962] +++ exited with 0 +++ [pid 961] +++ exited with 0 +++ [pid 960] +++ exited with 0 +++ [pid 957] +++ exited with 0 +++ [pid 954] +++ exited with 0 +++ [pid 951] +++ exited with 0 +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=954, si_uid=0, si_status=0, si_utime=0, si_stime=8} --- [pid 298] umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=951, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 298] openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 977 attached [pid 300] umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... openat resumed>) = 3 [pid 296] <... restart_syscall resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] fstat(3, [pid 300] openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... openat resumed>) = 3 [pid 298] getdents64(3, [pid 296] umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] fstat(3, [pid 298] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 298] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] getdents64(3, [pid 298] <... umount2 resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 300] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 298] umount2("./27/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] fstat(3, [pid 300] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] <... umount2 resumed>) = 0 [pid 298] lstat("./27/bus", [pid 296] getdents64(3, [pid 300] umount2("./24/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 5 entries */, 32768) = 136 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] unlink("./27/bus" [pid 296] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] lstat("./24/bus", [pid 298] <... unlink resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 300] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 298] umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./25/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] unlink("./24/bus" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 977] set_robust_list(0x555556c9c5e0, 24 [pid 300] <... unlink resumed>) = 0 [pid 298] lstat("./27/binderfs", [pid 296] lstat("./25/bus", [pid 977] <... set_robust_list resumed>) = 0 [pid 300] umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFREG|000, st_size=0, ...}) = 0 [pid 977] chdir("./26" [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] unlink("./27/binderfs" [pid 296] unlink("./25/bus" [pid 977] <... chdir resumed>) = 0 [pid 300] lstat("./24/binderfs", [pid 298] <... unlink resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 977] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 300] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 298] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 977] <... prctl resumed>) = 0 [pid 300] unlink("./24/binderfs" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 977] setpgid(0, 0 [pid 300] <... unlink resumed>) = 0 [pid 298] lstat("./27/file1", [pid 296] lstat("./25/binderfs", [pid 977] <... setpgid resumed>) = 0 [pid 300] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 [pid 977] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] umount2("./27/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./25/binderfs" [pid 977] <... openat resumed>) = 3 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... unlink resumed>) = 0 [pid 977] write(3, "1000", 4 [pid 298] openat(AT_FDCWD, "./27/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 977] <... write resumed>) = 4 [pid 298] <... openat resumed>) = 4 [pid 977] close(3 [pid 298] fstat(4, [pid 977] <... close resumed>) = 0 [pid 298] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 977] symlink("/dev/binderfs", "./binderfs" [pid 298] getdents64(4, [pid 977] <... symlink resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 977] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(4, [pid 977] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 977] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 966] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 298] close(4 [pid 977] <... mmap resumed>) = 0x7f35deafe000 [pid 298] <... close resumed>) = 0 [pid 977] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 298] rmdir("./27/file1" [pid 977] <... mprotect resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 977] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 298] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 977] <... clone resumed>, parent_tid=[981], tls=0x7f35deb1e700, child_tidptr=0x7f35deb1e9d0) = 981 [pid 298] close(3 [pid 977] futex(0x7f35debf77a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 977] <... futex resumed>) = 0 [pid 298] rmdir("./27" [pid 977] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... rmdir resumed>) = 0 [pid 977] <... futex resumed>) = 0 [pid 298] mkdir("./28", 0777 [pid 977] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... mkdir resumed>) = 0 [pid 977] <... mmap resumed>) = 0x7f35deadd000 [pid 298] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 977] mprotect(0x7f35deade000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 977] clone(child_stack=0x7f35deafd3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[982], tls=0x7f35deafd700, child_tidptr=0x7f35deafd9d0) = 982 [pid 977] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 977] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 981 attached [pid 981] set_robust_list(0x7f35deb1e9e0, 24./strace-static-x86_64: Process 982 attached ) = 0 [pid 981] memfd_create("syzkaller", 0) = 3 [pid 981] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f35d66dd000 [ 32.754305][ T975] [pid 981] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 981] munmap(0x7f35d66dd000, 262144) = 0 [pid 981] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 981] ioctl(4, LOOP_SET_FD, 3 [pid 298] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 984 [pid 982] set_robust_list(0x7f35deafd9e0, 24 [pid 981] <... ioctl resumed>) = 0 [pid 981] close(3) = 0 [pid 981] mkdir("./file1", 0777) = 0 [ 32.805298][ T969] EXT4-fs (loop4): 1 orphan inode deleted [ 32.810510][ T981] loop0: detected capacity change from 0 to 512 [ 32.811378][ T975] EXT4-fs (loop2): 1 orphan inode deleted [ 32.823000][ T969] EXT4-fs (loop4): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 32.845855][ T981] EXT4-fs (loop0): Mount option "nouser_xattr" will be removed by 3.5 [pid 981] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, "nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,ini"..../strace-static-x86_64: Process 984 attached [pid 982] <... set_robust_list resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 977] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 300] <... umount2 resumed>) = 0 [pid 977] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 977] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f35d66fc000 [pid 977] mprotect(0x7f35d66fd000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 977] clone(child_stack=0x7f35d671c3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[985], tls=0x7f35d671c700, child_tidptr=0x7f35d671c9d0) = 985 [pid 977] futex(0x7f35debf77c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 977] <... futex resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 977] futex(0x7f35debf77cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] lstat("./24/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] umount2("./24/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./24/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 300] fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 300] getdents64(4, 0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 300] getdents64(4, 0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 300] close(4) = 0 [pid 300] rmdir("./24/file1") = 0 [pid 300] getdents64(3, 0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 300] close(3) = 0 [pid 300] rmdir("./24") = 0 [pid 300] mkdir("./25", 0777) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 300] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 300] close(3) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556c9c5d0) = 986 [pid 984] set_robust_list(0x555556c9c5e0, 24 [pid 982] open("./bus", O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_LARGEFILE|O_NOATIME|0x3c, 000 [pid 296] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 984] <... set_robust_list resumed>) = 0 [pid 982] <... open resumed>) = 3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 984] chdir("./28" [pid 982] futex(0x7f35debf77bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] lstat("./25/file1", [pid 984] <... chdir resumed>) = 0 [pid 982] <... futex resumed>) = 0 [pid 296] <... lstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 984] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 982] futex(0x7f35debf77b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] umount2("./25/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 984] <... prctl resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 984] setpgid(0, 0 [pid 296] openat(AT_FDCWD, "./25/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 984] <... setpgid resumed>) = 0 [pid 296] <... openat resumed>) = 4 [ 32.845855][ T981] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 32.845855][ T981] [ 32.847126][ T975] EXT4-fs (loop2): mounted filesystem without journal. Opts: nouser_xattr,init_itable,i_version,grpquota,noauto_da_alloc,resgid=0x0000000000000000,sysvgroups,init_itable=0x000000000000c204,usrquota,,errors=continue. Quota mode: writeback. [ 32.884282][ T969] ext4 filesystem being mounted at /root/syzkaller.RJEgPO/28/file1 supports timestamps until 2038 (0x7fffffff) [pid 984] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] fstat(4, [pid 984] <... openat resumed>) = 3 [pid 296] <... fstat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 [pid 984] write(3, "1000", 4 [pid 296] getdents64(4, [pid 984] <... write resumed>) = 4 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 2 entries */, 32768) = 48 [pid 984] close(3 [pid 296] getdents64(4, ./strace-static-x86_64: Process 986 attached ./strace-static-x86_64: Process 985 attached [pid 984] <... close resumed>) = 0 [pid 975] <... mount resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556ca5660 /* 0 entries */, 32768) = 0 [pid 986] set_robust_list(0x555556c9c5e0, 24 [pid 985] set_robust_list(0x7f35d671c9e0, 24 [pid 984] symlink("/dev/binderfs", "./binderfs" [pid 975] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 296] close(4 [pid 986] <... set_robust_list resumed>) = 0 [pid 985] <... set_robust_list resumed>) = 0 [pid 984] <... symlink resumed>) = 0 [pid 975] <... openat resumed>) = 5 [pid 296] <... close resumed>) = 0 [pid 986] chdir("./25" [pid 985] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 984] futex(0x7f35debf77ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 975] chdir("./file1" [pid 296] rmdir("./25/file1" [pid 986] <... chdir resumed>) = 0 [pid 985] <... mount resumed>) = 0 [pid 984] <... futex resumed>) = 0 [pid 975] <... chdir resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 986] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 985] futex(0x7f35debf77cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 984] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 975] ioctl(6, LOOP_CLR_FD [pid 296] getdents64(3, [pid 986] <... prctl resumed>) = 0 [pid 985] <... futex resumed>) = 1 [pid 984] <... mmap resumed>) = 0x7f35deafe000 [pid 977] <... futex resumed>) = 0 [pid 975] <... ioctl resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556c9d620 /* 0 entries */, 32768) = 0 [pid 986] setpgid(0, 0 [pid 985] futex(0x7f35debf77c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 984] mprotect(0x7f35deaff000, 131072, PROT_READ|PROT_WRITE [pid 977] futex(0x7f35debf77b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 975] close(6 [pid 296] close(3 [pid 986] <... setpgid resumed>) = 0 [pid 984] <... mprotect resumed>) = 0 [pid 982] <... futex resumed>) = 0 [pid 977] <... futex resumed>) = 1 [pid 975] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 986] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 984] clone(child_stack=0x7f35deb1e3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID [pid 982] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c [pid 977] futex(0x7f35debf77bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 32.887107][ T975] ext4 filesystem being mounted at /root/syzkaller.7ngmbG/27/file1 supports timestamps until 2038 (0x7fffffff)