./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2871868906

<...>
Warning: Permanently added '10.128.0.113' (ECDSA) to the list of known hosts.
execve("./syz-executor2871868906", ["./syz-executor2871868906"], 0x7ffce279b910 /* 10 vars */) = 0
brk(NULL)                               = 0x555556e9a000
brk(0x555556e9ac40)                     = 0x555556e9ac40
arch_prctl(ARCH_SET_FS, 0x555556e9a300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor2871868906", 4096) = 28
brk(0x555556ebbc40)                     = 0x555556ebbc40
brk(0x555556ebc000)                     = 0x555556ebc000
mprotect(0x7f99dded4000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mount(NULL, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, NULL) = -1 EBUSY (Device or resource busy)
openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3
write(3, "\x3a\x73\x79\x7a\x30\x3a\x4d\x3a\x30\x3a\x01\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a", 21) = 21
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3
write(3, "\x3a\x73\x79\x7a\x31\x3a\x4d\x3a\x31\x3a\x02\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a\x50\x4f\x43", 24) = 24
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
chmod("/dev/raw-gadget", 0666)          = 0
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 3604 attached
, child_tidptr=0x555556e9a5d0) = 3604
[pid  3604] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  3604] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  3604] setsid()                    = 1
[pid  3604] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  3604] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  3604] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  3604] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  3604] prlimit64(0, RLIMIT_CORE, {rlim_cur=0, rlim_max=0}, NULL) = 0
[pid  3604] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  3604] unshare(CLONE_NEWNS)        = 0
[pid  3604] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  3604] unshare(CLONE_NEWIPC)       = 0
[pid  3604] unshare(CLONE_NEWCGROUP)    = 0
[pid  3604] unshare(CLONE_NEWUTS)       = 0
[pid  3604] unshare(CLONE_SYSVSEM)      = 0
[pid  3604] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  3604] write(3, "16777216", 8)     = 8
[pid  3604] close(3)                    = 0
[pid  3604] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  3604] write(3, "536870912", 9)    = 9
[pid  3604] close(3)                    = 0
[pid  3604] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  3604] write(3, "1024", 4)         = 4
[pid  3604] close(3)                    = 0
[pid  3604] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  3604] write(3, "8192", 4)         = 4
[pid  3604] close(3)                    = 0
[pid  3604] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  3604] write(3, "1024", 4)         = 4
[pid  3604] close(3)                    = 0
[pid  3604] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  3604] write(3, "1024", 4)         = 4
[pid  3604] close(3)                    = 0
[pid  3604] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  3604] write(3, "1024 1048576 500 1024", 21) = 21
[pid  3604] close(3)                    = 0
[pid  3604] getpid()                    = 1
[pid  3604] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  3604] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  3604] unshare(CLONE_NEWNET)       = 0
[pid  3604] mkdir("/dev/binderfs", 0777) = 0
[pid  3604] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  3604] symlink("/dev/binderfs", "./binderfs") = 0
[pid  3604] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556e9a5d0) = 2
./strace-static-x86_64: Process 3605 attached
[pid  3605] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  3605] setpgid(0, 0)               = 0
[pid  3605] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  3605] write(3, "1000", 4)         = 4
[pid  3605] close(3)                    = 0
[pid  3605] openat(AT_FDCWD, "./binderfs/binder1", O_RDONLY) = 3
[pid  3605] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 4
[pid  3605] write(4, "11", 2)           = 2
[pid  3605] mmap(0x20fff000, 4096, PROT_READ, MAP_SHARED|MAP_FIXED, 3, 0) = -1 ENOMEM (Cannot allocate memory)
[pid  3605] close(3)                    = 0
[pid  3605] close(4)                    = 0
[pid  3605] close(5)                    = -1 EBADF (Bad file descriptor)
[pid  3605] close(6)                    = -1 EBADF (Bad file descriptor)
[pid  3605] close(7)                    = -1 EBADF (Bad file descriptor)
[pid  3605] close(8)                    = -1 EBADF (Bad file descriptor)
[pid  3605] close(9)                    = -1 EBADF (Bad file descriptor)
[pid  3605] close(10)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(11)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(12)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(13)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(14)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(15)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(16)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(17)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(18)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(19)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(20)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(21)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(22)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(23)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(24)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(25)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(26)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(27)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(28)                   = -1 EBADF (Bad file descriptor)
[pid  3605] close(29)                   = -1 EBADF (Bad file descriptor)
syzkaller login: [   49.642240][ T2934] ------------[ cut here ]------------
[   49.642247][ T2934] kernel BUG at drivers/android/binder_alloc.c:820!
[   49.642265][ T2934] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[   49.660337][ T2934] CPU: 0 PID: 2934 Comm: kworker/0:3 Not tainted 5.19.0-rc2-next-20220615-syzkaller #0
[   49.669969][ T2934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   49.680033][ T2934] Workqueue: events binder_deferred_func
[   49.685679][ T2934] RIP: 0010:binder_alloc_deferred_release+0x602/0x780
[   49.692462][ T2934] Code: c6 80 16 c7 8a 48 c7 c7 80 b6 48 8d e8 57 86 05 fd 31 ff 89 c5 89 c6 e8 fc ba 5b fa 85 ed 74 c6 e9 78 57 55 02 e8 9e be 5b fa <0f> 0b c7 44 24 20 00 00 00 00 e9 27 ff ff ff e8 8a be 5b fa 48 89
[   49.712083][ T2934] RSP: 0018:ffffc9000de07bc8 EFLAGS: 00010293
[   49.718150][ T2934] RAX: 0000000000000000 RBX: ffff8880519971e0 RCX: 0000000000000000
[   49.726139][ T2934] RDX: ffff888026b0d7c0 RSI: ffffffff871f04b2 RDI: ffff888051997270
[   49.734124][ T2934] RBP: ffff888051997000 R08: 0000000000000000 R09: ffffffff8dbcac17
[   49.742180][ T2934] R10: fffffbfff1b79582 R11: 0000000000000000 R12: ffff888147653c60
[   49.750144][ T2934] R13: ffff8880519972d8 R14: ffff888147653d10 R15: dffffc0000000000
[   49.758111][ T2934] FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[   49.767038][ T2934] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   49.773616][ T2934] CR2: 00007f99ddec19c1 CR3: 0000000077a01000 CR4: 00000000003506f0
[   49.781589][ T2934] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   49.789558][ T2934] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   49.797542][ T2934] Call Trace:
[   49.800818][ T2934]  <TASK>
[   49.803781][ T2934]  binder_proc_dec_tmpref+0x2aa/0x530
[   49.809164][ T2934]  binder_deferred_func+0xe2a/0x1150
[   49.814468][ T2934]  process_one_work+0x996/0x1610
[   49.819430][ T2934]  ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[   49.824817][ T2934]  ? rwlock_bug.part.0+0x90/0x90
[   49.829752][ T2934]  ? _raw_spin_lock_irq+0x41/0x50
[   49.834780][ T2934]  worker_thread+0x665/0x1080
[   49.839461][ T2934]  ? __kthread_parkme+0x15f/0x220
[   49.844480][ T2934]  ? process_one_work+0x1610/0x1610
[   49.849676][ T2934]  kthread+0x2e9/0x3a0
[   49.853737][ T2934]  ? kthread_complete_and_exit+0x40/0x40
[   49.859367][ T2934]  ret_from_fork+0x1f/0x30
[   49.863788][ T2934]  </TASK>
[   49.866798][ T2934] Modules linked in:
[   49.872203][ T2934] ---[ end trace 0000000000000000 ]---
[   49.872215][ T2934] RIP: 0010:binder_alloc_deferred_release+0x602/0x780
[   49.872247][ T2934] Code: c6 80 16 c7 8a 48 c7 c7 80 b6 48 8d e8 57 86 05 fd 31 ff 89 c5 89 c6 e8 fc ba 5b fa 85 ed 74 c6 e9 78 57 55 02 e8 9e be 5b fa <0f> 0b c7 44 24 20 00 00 00 00 e9 27 ff ff ff e8 8a be 5b fa 48 89
[   49.872269][ T2934] RSP: 0018:ffffc9000de07bc8 EFLAGS: 00010293
[   49.872287][ T2934] RAX: 0000000000000000 RBX: ffff8880519971e0 RCX: 0000000000000000
[   49.872299][ T2934] RDX: ffff888026b0d7c0 RSI: ffffffff871f04b2 RDI: ffff888051997270
[   49.872310][ T2934] RBP: ffff888051997000 R08: 0000000000000000 R09: ffffffff8dbcac17
[   49.872322][ T2934] R10: fffffbfff1b79582 R11: 0000000000000000 R12: ffff888147653c60
[   49.872332][ T2934] R13: ffff8880519972d8 R14: ffff888147653d10 R15: dffffc0000000000
[   49.872342][ T2934] FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[   49.872356][ T2934] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   49.872364][ T2934] CR2: 00007f99ddec19c1 CR3: 000000001bb00000 CR4: 00000000003506f0
[   49.872372][ T2934] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   49.872379][ T2934] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   49.872388][ T2934] Kernel panic - not syncing: Fatal exception
[   49.995533][ T2934] Kernel Offset: disabled
[   49.999856][ T2934] Rebooting in 86400 seconds..