./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1974191340

<...>
Warning: Permanently added '10.128.1.13' (ED25519) to the list of known hosts.
execve("./syz-executor1974191340", ["./syz-executor1974191340"], 0x7ffd366ecd60 /* 10 vars */) = 0
brk(NULL)                               = 0x5555573e4000
brk(0x5555573e4d00)                     = 0x5555573e4d00
arch_prctl(ARCH_SET_FS, 0x5555573e4380) = 0
set_tid_address(0x5555573e4650)         = 355
set_robust_list(0x5555573e4660, 24)     = 0
rseq(0x5555573e4ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented)
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1974191340", 4096) = 28
getrandom("\x3c\xd9\x1e\x28\xe2\x0a\x93\xa4", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x5555573e4d00
brk(0x555557405d00)                     = 0x555557405d00
brk(0x555557406000)                     = 0x555557406000
mprotect(0x7f88194d7000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.3xWg9B", 0700)       = 0
chmod("./syzkaller.3xWg9B", 0777)       = 0
chdir("./syzkaller.3xWg9B")             = 0
mkdir("./0", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 357
./strace-static-x86_64: Process 357 attached
[pid   357] set_robust_list(0x5555573e4660, 24) = 0
[pid   357] chdir("./0")                = 0
[pid   357] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   357] setpgid(0, 0)               = 0
[pid   357] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   357] write(3, "1000", 4)         = 4
[pid   357] close(3)                    = 0
[pid   357] symlink("/dev/binderfs", "./binderfs") = 0
[pid   357] memfd_create("syzkaller", 0) = 3
[pid   357] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   357] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   357] munmap(0x7f8811023000, 1048576) = 0
[pid   357] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   357] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   357] close(3)                    = 0
[pid   357] mkdir("./file0", 0777)      = 0
[   22.375280][   T23] audit: type=1400 audit(1689413735.110:66): avc:  denied  { execmem } for  pid=355 comm="syz-executor197" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   22.381160][   T23] audit: type=1400 audit(1689413735.110:67): avc:  denied  { read write } for  pid=355 comm="syz-executor197" name="loop0" dev="devtmpfs" ino=9308 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[   22.385181][   T23] audit: type=1400 audit(1689413735.110:68): avc:  denied  { open } for  pid=355 comm="syz-executor197" path="/dev/loop0" dev="devtmpfs" ino=9308 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[   22.388819][   T23] audit: type=1400 audit(1689413735.130:69): avc:  denied  { ioctl } for  pid=355 comm="syz-executor197" path="/dev/loop0" dev="devtmpfs" ino=9308 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[pid   357] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   357] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   357] chdir("./file0")            = 0
[pid   357] ioctl(4, LOOP_CLR_FD)       = 0
[pid   357] close(4)                    = 0
[pid   357] creat("./bus", 000)         = 4
[pid   357] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   357] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[   22.403942][   T23] audit: type=1400 audit(1689413735.140:70): avc:  denied  { mounton } for  pid=357 comm="syz-executor197" path="/root/syzkaller.3xWg9B/0/file0" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[   22.435183][  T357] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   22.444200][   T23] audit: type=1400 audit(1689413735.180:71): avc:  denied  { mount } for  pid=357 comm="syz-executor197" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[pid   357] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   357] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   22.467427][   T23] audit: type=1400 audit(1689413735.180:72): avc:  denied  { write } for  pid=357 comm="syz-executor197" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[   22.475043][  T357] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   22.491342][   T23] audit: type=1400 audit(1689413735.180:73): avc:  denied  { add_name } for  pid=357 comm="syz-executor197" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[pid   357] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   357] exit_group(0)               = ?
[pid   357] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=357, si_uid=0, si_status=0, si_utime=0, si_stime=9} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs")                  = 0
[   22.503475][  T357] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
[   22.523989][   T23] audit: type=1400 audit(1689413735.180:74): avc:  denied  { create } for  pid=357 comm="syz-executor197" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./0/file0")                      = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./0")                            = 0
mkdir("./1", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 362
./strace-static-x86_64: Process 362 attached
[pid   362] set_robust_list(0x5555573e4660, 24) = 0
[pid   362] chdir("./1")                = 0
[pid   362] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   362] setpgid(0, 0)               = 0
[pid   362] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   362] write(3, "1000", 4)         = 4
[pid   362] close(3)                    = 0
[pid   362] symlink("/dev/binderfs", "./binderfs") = 0
[pid   362] memfd_create("syzkaller", 0) = 3
[pid   362] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   362] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   362] munmap(0x7f8811023000, 1048576) = 0
[pid   362] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   362] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   362] close(3)                    = 0
[pid   362] mkdir("./file0", 0777)      = 0
[   22.558645][   T23] audit: type=1400 audit(1689413735.180:75): avc:  denied  { write open } for  pid=357 comm="syz-executor197" path="/root/syzkaller.3xWg9B/0/file0/bus" dev="loop0" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1
[pid   362] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   362] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   362] chdir("./file0")            = 0
[pid   362] ioctl(4, LOOP_CLR_FD)       = 0
[pid   362] close(4)                    = 0
[pid   362] creat("./bus", 000)         = 4
[pid   362] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   362] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   362] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   362] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   22.644151][  T362] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   22.668581][  T362] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[pid   362] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   362] exit_group(0)               = ?
[pid   362] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=362, si_uid=0, si_status=0, si_utime=0, si_stime=5} ---
umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./1/binderfs")                  = 0
[   22.680967][  T362] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./1/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./1/file0")                      = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./1")                            = 0
mkdir("./2", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 366
./strace-static-x86_64: Process 366 attached
[pid   366] set_robust_list(0x5555573e4660, 24) = 0
[pid   366] chdir("./2")                = 0
[pid   366] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   366] setpgid(0, 0)               = 0
[pid   366] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   366] write(3, "1000", 4)         = 4
[pid   366] close(3)                    = 0
[pid   366] symlink("/dev/binderfs", "./binderfs") = 0
[pid   366] memfd_create("syzkaller", 0) = 3
[pid   366] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   366] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   366] munmap(0x7f8811023000, 1048576) = 0
[pid   366] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   366] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   366] close(3)                    = 0
[pid   366] mkdir("./file0", 0777)      = 0
[pid   366] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   366] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   366] chdir("./file0")            = 0
[pid   366] ioctl(4, LOOP_CLR_FD)       = 0
[pid   366] close(4)                    = 0
[pid   366] creat("./bus", 000)         = 4
[pid   366] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   366] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   366] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   366] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   366] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   366] exit_group(0)               = ?
[pid   366] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=366, si_uid=0, si_status=0, si_utime=1, si_stime=3} ---
umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
[   22.824495][  T366] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   22.841564][  T366] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   22.854250][  T366] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
unlink("./2/binderfs")                  = 0
umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./2/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./2/file0")                      = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./2")                            = 0
mkdir("./3", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
[   22.872910][  T366] syz-executor197 (366) used greatest stack depth: 21624 bytes left
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 371
./strace-static-x86_64: Process 371 attached
[pid   371] set_robust_list(0x5555573e4660, 24) = 0
[pid   371] chdir("./3")                = 0
[pid   371] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   371] setpgid(0, 0)               = 0
[pid   371] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   371] write(3, "1000", 4)         = 4
[pid   371] close(3)                    = 0
[pid   371] symlink("/dev/binderfs", "./binderfs") = 0
[pid   371] memfd_create("syzkaller", 0) = 3
[pid   371] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   371] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   371] munmap(0x7f8811023000, 1048576) = 0
[pid   371] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   371] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   371] close(3)                    = 0
[pid   371] mkdir("./file0", 0777)      = 0
[pid   371] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   371] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   371] chdir("./file0")            = 0
[pid   371] ioctl(4, LOOP_CLR_FD)       = 0
[pid   371] close(4)                    = 0
[pid   371] creat("./bus", 000)         = 4
[pid   371] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   371] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   371] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   371] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   22.964365][  T371] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   22.987867][  T371] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[pid   371] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   371] exit_group(0)               = ?
[pid   371] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=371, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./3/binderfs")                  = 0
[   23.000415][  T371] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./3/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./3/file0")                      = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./3")                            = 0
mkdir("./4", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 375
./strace-static-x86_64: Process 375 attached
[pid   375] set_robust_list(0x5555573e4660, 24) = 0
[pid   375] chdir("./4")                = 0
[pid   375] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   375] setpgid(0, 0)               = 0
[pid   375] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   375] write(3, "1000", 4)         = 4
[pid   375] close(3)                    = 0
[pid   375] symlink("/dev/binderfs", "./binderfs") = 0
[pid   375] memfd_create("syzkaller", 0) = 3
[pid   375] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   375] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   375] munmap(0x7f8811023000, 1048576) = 0
[pid   375] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   375] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   375] close(3)                    = 0
[pid   375] mkdir("./file0", 0777)      = 0
[pid   375] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   375] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   375] chdir("./file0")            = 0
[pid   375] ioctl(4, LOOP_CLR_FD)       = 0
[pid   375] close(4)                    = 0
[pid   375] creat("./bus", 000)         = 4
[pid   375] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   375] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   375] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   375] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   375] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   375] exit_group(0)               = ?
[pid   375] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=375, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./4/binderfs")                  = 0
[   23.134310][  T375] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   23.155200][  T375] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   23.167752][  T375] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./4/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./4/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./4/file0")                      = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./4")                            = 0
mkdir("./5", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 379
./strace-static-x86_64: Process 379 attached
[pid   379] set_robust_list(0x5555573e4660, 24) = 0
[pid   379] chdir("./5")                = 0
[pid   379] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   379] setpgid(0, 0)               = 0
[pid   379] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   379] write(3, "1000", 4)         = 4
[pid   379] close(3)                    = 0
[pid   379] symlink("/dev/binderfs", "./binderfs") = 0
[pid   379] memfd_create("syzkaller", 0) = 3
[pid   379] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   379] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   379] munmap(0x7f8811023000, 1048576) = 0
[pid   379] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   379] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   379] close(3)                    = 0
[pid   379] mkdir("./file0", 0777)      = 0
[pid   379] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   379] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   379] chdir("./file0")            = 0
[pid   379] ioctl(4, LOOP_CLR_FD)       = 0
[pid   379] close(4)                    = 0
[pid   379] creat("./bus", 000)         = 4
[pid   379] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   379] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   379] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   379] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   23.294057][  T379] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   23.315536][  T379] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   23.327883][  T379] ==================================================================
[   23.335746][  T379] BUG: KASAN: use-after-free in get_max_inline_xattr_value_size+0x369/0x510
[   23.344244][  T379] Read of size 4 at addr ffff8881dc88e004 by task syz-executor197/379
[   23.352225][  T379] 
[   23.354399][  T379] CPU: 0 PID: 379 Comm: syz-executor197 Not tainted 5.4.242-syzkaller #0
[   23.362644][  T379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
[   23.372536][  T379] Call Trace:
[   23.375670][  T379]  dump_stack+0x1d8/0x241
[   23.379845][  T379]  ? nf_ct_l4proto_log_invalid+0x258/0x258
[   23.385472][  T379]  ? printk+0xd1/0x111
[   23.389378][  T379]  ? get_max_inline_xattr_value_size+0x369/0x510
[   23.395538][  T379]  ? wake_up_klogd+0xb2/0xf0
[   23.399966][  T379]  ? get_max_inline_xattr_value_size+0x369/0x510
[   23.406131][  T379]  print_address_description+0x8c/0x600
[   23.411514][  T379]  ? panic+0x896/0x896
[   23.415430][  T379]  ? get_max_inline_xattr_value_size+0x369/0x510
[   23.421580][  T379]  __kasan_report+0xf3/0x120
[   23.426007][  T379]  ? get_max_inline_xattr_value_size+0x369/0x510
[   23.432166][  T379]  kasan_report+0x30/0x60
[   23.436331][  T379]  get_max_inline_xattr_value_size+0x369/0x510
[   23.442323][  T379]  ext4_get_max_inline_size+0x134/0x1f0
[   23.447702][  T379]  ? asan.module_dtor+0x20/0x20
[   23.452392][  T379]  ? blk_attempt_plug_merge+0x300/0x300
[   23.457769][  T379]  ext4_try_to_write_inline_data+0xda/0x1720
[   23.463590][  T379]  ? __bio_add_page+0x294/0x450
[   23.468281][  T379]  ? submit_bio+0x1bf/0x6d0
[   23.472611][  T379]  ? PageUptodate+0xb0/0xb0
[   23.476952][  T379]  ? ext4_writepage_trans_blocks+0x367/0x600
[   23.482769][  T379]  ext4_write_begin+0x25a/0x1900
[   23.487542][  T379]  ? ext4_commit_super+0x898/0xa40
[   23.492488][  T379]  ? __ext4_error_inode+0x302/0x630
[   23.497521][  T379]  ? ext4_readpages+0x110/0x110
[   23.502207][  T379]  ? ext4_handle_error+0x3d0/0x3d0
[   23.507156][  T379]  ? ext4_get_inode_loc+0x60/0x60
[   23.512014][  T379]  ? check_preemption_disabled+0x9f/0x320
[   23.517569][  T379]  ? __xattr_check_inode+0x375/0x3f0
[   23.522689][  T379]  ? __mod_memcg_state+0x93/0x200
[   23.527551][  T379]  ? __brelse+0x55/0x90
[   23.531543][  T379]  ? ext4_xattr_ibody_get+0x2b7/0x720
[   23.536753][  T379]  ext4_da_write_begin+0x4a3/0xfe0
[   23.541712][  T379]  ? down_write_trylock+0x130/0x130
[   23.546733][  T379]  ? cpuacct_charge+0xe2/0x170
[   23.551336][  T379]  ? ext4_set_page_dirty+0x190/0x190
[   23.556456][  T379]  ? ext4_initxattrs+0x110/0x110
[   23.561229][  T379]  ? __vfs_getxattr+0x600/0x6d0
[   23.565916][  T379]  ? wb_get_create+0xd51/0xd90
[   23.570516][  T379]  ? iov_iter_fault_in_readable+0x313/0x4c0
[   23.576245][  T379]  ? asan.module_dtor+0x20/0x20
[   23.580931][  T379]  ? wb_io_lists_depopulated+0x85/0x170
[   23.586312][  T379]  ? inode_io_list_move_locked+0x2b5/0x300
[   23.591951][  T379]  generic_perform_write+0x2c7/0x560
[   23.597076][  T379]  ? grab_cache_page_write_begin+0x90/0x90
[   23.602714][  T379]  ? file_remove_privs+0x640/0x640
[   23.607664][  T379]  ? debug_smp_processor_id+0x20/0x20
[   23.612871][  T379]  ? down_write_trylock+0xd7/0x130
[   23.617816][  T379]  __generic_file_write_iter+0x224/0x530
[   23.623287][  T379]  ext4_file_write_iter+0x499/0x10e0
[   23.628412][  T379]  ? ext4_file_read_iter+0x140/0x140
[   23.633527][  T379]  ? _raw_spin_lock_irq+0xa5/0x1b0
[   23.638472][  T379]  ? _raw_spin_lock_irqsave+0x210/0x210
[   23.643856][  T379]  ? cgroup_update_frozen+0x157/0xab0
[   23.649063][  T379]  ? cgroup_update_frozen+0x157/0xab0
[   23.654270][  T379]  ? cgroup_leave_frozen+0x13c/0x290
[   23.659389][  T379]  ? iov_iter_init+0x82/0x160
[   23.663905][  T379]  __vfs_write+0x5d3/0x750
[   23.668157][  T379]  ? __kernel_write+0x350/0x350
[   23.672843][  T379]  ? check_preemption_disabled+0x9f/0x320
[   23.678426][  T379]  ? debug_smp_processor_id+0x20/0x20
[   23.683608][  T379]  ? selinux_file_permission+0x2be/0x530
[   23.689077][  T379]  vfs_write+0x206/0x4e0
[   23.693154][  T379]  ksys_write+0x199/0x2c0
[   23.697319][  T379]  ? do_syscall_64+0x1c0/0x1c0
[   23.701921][  T379]  ? __ia32_sys_read+0x80/0x80
[   23.706520][  T379]  do_syscall_64+0xca/0x1c0
[   23.710861][  T379]  entry_SYSCALL_64_after_hwframe+0x5c/0xc1
[   23.716586][  T379] 
[   23.718754][  T379] Allocated by task 350:
[   23.722839][  T379]  __kasan_kmalloc+0x171/0x210
[   23.727436][  T379]  kmem_cache_alloc+0xd9/0x250
[   23.732035][  T379]  skb_clone+0x1c0/0x360
[   23.736114][  T379]  dev_queue_xmit_nit+0x258/0xa10
[   23.740973][  T379]  dev_hard_start_xmit+0x12b/0x6b0
[   23.745924][  T379]  sch_direct_xmit+0x28f/0xa10
[   23.750522][  T379]  __qdisc_run+0xa14/0x1e80
[   23.754862][  T379]  qdisc_run+0xf8/0x300
[   23.758857][  T379]  __dev_queue_xmit+0xb43/0x27e0
[   23.763628][  T379]  ip_finish_output2+0xb4f/0xfc0
[   23.768405][  T379]  ip_output+0x19b/0x3a0
[   23.772480][  T379]  __ip_queue_xmit+0xfaa/0x1850
[   23.777169][  T379]  __tcp_transmit_skb+0x1de5/0x3390
[   23.782203][  T379]  tcp_write_xmit+0x17b0/0x5cd0
[   23.786893][  T379]  __tcp_push_pending_frames+0x91/0x2e0
[   23.792268][  T379]  tcp_sendmsg_locked+0x2fff/0x3810
[   23.797307][  T379]  tcp_sendmsg+0x2c/0x40
[   23.801383][  T379]  sock_write_iter+0x344/0x470
[   23.806001][  T379]  __vfs_write+0x5d3/0x750
[   23.810243][  T379]  vfs_write+0x206/0x4e0
[   23.814329][  T379]  ksys_write+0x199/0x2c0
[   23.818485][  T379]  do_syscall_64+0xca/0x1c0
[   23.822826][  T379]  entry_SYSCALL_64_after_hwframe+0x5c/0xc1
[   23.828574][  T379] 
[   23.830717][  T379] Freed by task 350:
[   23.834454][  T379]  __kasan_slab_free+0x1b5/0x270
[   23.839225][  T379]  kmem_cache_free+0x10b/0x2c0
[   23.843827][  T379]  packet_rcv+0x13b/0x1170
[   23.848082][  T379]  dev_queue_xmit_nit+0x976/0xa10
[   23.852940][  T379]  dev_hard_start_xmit+0x12b/0x6b0
[   23.857884][  T379]  sch_direct_xmit+0x28f/0xa10
[   23.862484][  T379]  __qdisc_run+0xa14/0x1e80
[   23.866826][  T379]  qdisc_run+0xf8/0x300
[   23.870820][  T379]  __dev_queue_xmit+0xb43/0x27e0
[   23.875593][  T379]  ip_finish_output2+0xb4f/0xfc0
[   23.880364][  T379]  ip_output+0x19b/0x3a0
[   23.884446][  T379]  __ip_queue_xmit+0xfaa/0x1850
[   23.889132][  T379]  __tcp_transmit_skb+0x1de5/0x3390
[   23.894165][  T379]  tcp_write_xmit+0x17b0/0x5cd0
[   23.898852][  T379]  __tcp_push_pending_frames+0x91/0x2e0
[   23.904247][  T379]  tcp_sendmsg_locked+0x2fff/0x3810
[   23.909267][  T379]  tcp_sendmsg+0x2c/0x40
[   23.913348][  T379]  sock_write_iter+0x344/0x470
[   23.917947][  T379]  __vfs_write+0x5d3/0x750
[   23.922199][  T379]  vfs_write+0x206/0x4e0
[   23.926279][  T379]  ksys_write+0x199/0x2c0
[   23.930444][  T379]  do_syscall_64+0xca/0x1c0
[   23.934802][  T379]  entry_SYSCALL_64_after_hwframe+0x5c/0xc1
[   23.940515][  T379] 
[   23.942688][  T379] The buggy address belongs to the object at ffff8881dc88e000
[   23.942688][  T379]  which belongs to the cache skbuff_head_cache of size 240
[   23.957100][  T379] The buggy address is located 4 bytes inside of
[   23.957100][  T379]  240-byte region [ffff8881dc88e000, ffff8881dc88e0f0)
[   23.970456][  T379] The buggy address belongs to the page:
[   23.975937][  T379] page:ffffea0007722380 refcount:1 mapcount:0 mapping:ffff8881f1cd8c80 index:0x0
[   23.984873][  T379] flags: 0x8000000000000200(slab)
[   23.989734][  T379] raw: 8000000000000200 dead000000000100 dead000000000122 ffff8881f1cd8c80
[   23.998148][  T379] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
[   24.006561][  T379] page dumped because: kasan: bad access detected
[   24.012964][  T379] page_owner tracks the page as allocated
[   24.018468][  T379] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY)
[   24.030264][  T379]  prep_new_page+0x18f/0x370
[   24.034686][  T379]  get_page_from_freelist+0x2d13/0x2d90
[   24.040064][  T379]  __alloc_pages_nodemask+0x393/0x840
[   24.045277][  T379]  alloc_slab_page+0x39/0x3c0
[   24.049789][  T379]  new_slab+0x97/0x440
[   24.053691][  T379]  ___slab_alloc+0x2fe/0x490
[   24.058121][  T379]  __slab_alloc+0x62/0xa0
[   24.062285][  T379]  kmem_cache_alloc+0x109/0x250
[   24.066972][  T379]  skb_clone+0x1c0/0x360
[   24.071051][  T379]  dev_queue_xmit_nit+0x258/0xa10
[   24.075914][  T379]  dev_hard_start_xmit+0x12b/0x6b0
[   24.080856][  T379]  sch_direct_xmit+0x28f/0xa10
[   24.085460][  T379]  __qdisc_run+0xa14/0x1e80
[   24.089798][  T379]  qdisc_run+0xf8/0x300
[   24.093795][  T379]  __dev_queue_xmit+0xb43/0x27e0
[   24.098564][  T379]  ip_finish_output2+0xb4f/0xfc0
[   24.103334][  T379] page last free stack trace:
[   24.107852][  T379]  free_unref_page_prepare+0x297/0x380
[   24.113144][  T379]  free_unref_page_list+0x10a/0x590
[   24.118180][  T379]  release_pages+0xad8/0xb20
[   24.122608][  T379]  pagevec_lru_move_fn+0x1cb/0x250
[   24.127554][  T379]  lru_add_drain_cpu+0x105/0x600
[   24.132326][  T379]  __pagevec_release+0x6e/0x150
[   24.137102][  T379]  shmem_undo_range+0x8a5/0x1ad0
[   24.142136][  T379]  shmem_evict_inode+0x218/0x9a0
[   24.146909][  T379]  evict+0x29b/0x6a0
[   24.150638][  T379]  __dentry_kill+0x429/0x630
[   24.155067][  T379]  dentry_kill+0xb8/0x280
[   24.159236][  T379]  dput+0x154/0x2f0
[   24.162879][  T379]  do_renameat2+0x9bd/0x1110
[   24.167304][  T379]  __x64_sys_rename+0x64/0x70
[   24.171823][  T379]  do_syscall_64+0xca/0x1c0
[   24.176161][  T379]  entry_SYSCALL_64_after_hwframe+0x5c/0xc1
[   24.181882][  T379] 
[   24.184052][  T379] Memory state around the buggy address:
[   24.189522][  T379]  ffff8881dc88df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   24.197419][  T379]  ffff8881dc88df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   24.205319][  T379] >ffff8881dc88e000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   24.213215][  T379]                    ^
[   24.217120][  T379]  ffff8881dc88e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[   24.225022][  T379]  ffff8881dc88e100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   24.232918][  T379] ==================================================================
[   24.240815][  T379] Disabling lock debugging due to kernel taint
[pid   379] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   379] exit_group(0)               = ?
[pid   379] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=379, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./5/binderfs")                  = 0
[   24.247129][  T379] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./5/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./5/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./5/file0")                      = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./5")                            = 0
mkdir("./6", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 384 attached
, child_tidptr=0x5555573e4650) = 384
[pid   384] set_robust_list(0x5555573e4660, 24) = 0
[pid   384] chdir("./6")                = 0
[pid   384] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   384] setpgid(0, 0)               = 0
[pid   384] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   384] write(3, "1000", 4)         = 4
[pid   384] close(3)                    = 0
[pid   384] symlink("/dev/binderfs", "./binderfs") = 0
[pid   384] memfd_create("syzkaller", 0) = 3
[pid   384] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   384] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   384] munmap(0x7f8811023000, 1048576) = 0
[pid   384] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   384] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   384] close(3)                    = 0
[pid   384] mkdir("./file0", 0777)      = 0
[pid   384] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   384] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   384] chdir("./file0")            = 0
[pid   384] ioctl(4, LOOP_CLR_FD)       = 0
[pid   384] close(4)                    = 0
[pid   384] creat("./bus", 000)         = 4
[pid   384] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   384] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   384] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   384] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   384] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   384] exit_group(0)               = ?
[pid   384] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=384, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./6/binderfs")                  = 0
[   24.374019][  T384] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   24.391988][  T384] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   24.404584][  T384] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./6/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./6/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./6/file0")                      = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./6")                            = 0
mkdir("./7", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 388
./strace-static-x86_64: Process 388 attached
[pid   388] set_robust_list(0x5555573e4660, 24) = 0
[pid   388] chdir("./7")                = 0
[pid   388] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   388] setpgid(0, 0)               = 0
[pid   388] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   388] write(3, "1000", 4)         = 4
[pid   388] close(3)                    = 0
[pid   388] symlink("/dev/binderfs", "./binderfs") = 0
[pid   388] memfd_create("syzkaller", 0) = 3
[pid   388] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   388] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   388] munmap(0x7f8811023000, 1048576) = 0
[pid   388] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   388] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   388] close(3)                    = 0
[pid   388] mkdir("./file0", 0777)      = 0
[pid   388] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   388] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   388] chdir("./file0")            = 0
[pid   388] ioctl(4, LOOP_CLR_FD)       = 0
[pid   388] close(4)                    = 0
[pid   388] creat("./bus", 000)         = 4
[pid   388] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   388] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   388] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   388] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   24.514096][  T388] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   24.537719][  T388] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[pid   388] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   388] exit_group(0)               = ?
[pid   388] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=388, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./7/binderfs")                  = 0
[   24.550241][  T388] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./7/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./7/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./7/file0")                      = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./7")                            = 0
mkdir("./8", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 393
./strace-static-x86_64: Process 393 attached
[pid   393] set_robust_list(0x5555573e4660, 24) = 0
[pid   393] chdir("./8")                = 0
[pid   393] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   393] setpgid(0, 0)               = 0
[pid   393] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   393] write(3, "1000", 4)         = 4
[pid   393] close(3)                    = 0
[pid   393] symlink("/dev/binderfs", "./binderfs") = 0
[pid   393] memfd_create("syzkaller", 0) = 3
[pid   393] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   393] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   393] munmap(0x7f8811023000, 1048576) = 0
[pid   393] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   393] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   393] close(3)                    = 0
[pid   393] mkdir("./file0", 0777)      = 0
[pid   393] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   393] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   393] chdir("./file0")            = 0
[pid   393] ioctl(4, LOOP_CLR_FD)       = 0
[pid   393] close(4)                    = 0
[pid   393] creat("./bus", 000)         = 4
[pid   393] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   393] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   393] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   393] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   24.704262][  T393] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   24.727691][  T393] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[pid   393] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   393] exit_group(0)               = ?
[pid   393] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=393, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./8/binderfs")                  = 0
umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./8/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./8/file0")                      = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./8")                            = 0
mkdir("./9", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 397
[   24.740249][  T393] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
./strace-static-x86_64: Process 397 attached
[pid   397] set_robust_list(0x5555573e4660, 24) = 0
[pid   397] chdir("./9")                = 0
[pid   397] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   397] setpgid(0, 0)               = 0
[pid   397] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   397] write(3, "1000", 4)         = 4
[pid   397] close(3)                    = 0
[pid   397] symlink("/dev/binderfs", "./binderfs") = 0
[pid   397] memfd_create("syzkaller", 0) = 3
[pid   397] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   397] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   397] munmap(0x7f8811023000, 1048576) = 0
[pid   397] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   397] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   397] close(3)                    = 0
[pid   397] mkdir("./file0", 0777)      = 0
[pid   397] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   397] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   397] chdir("./file0")            = 0
[pid   397] ioctl(4, LOOP_CLR_FD)       = 0
[pid   397] close(4)                    = 0
[pid   397] creat("./bus", 000)         = 4
[pid   397] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   397] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   397] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   397] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   397] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   397] exit_group(0)               = ?
[pid   397] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=397, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./9/binderfs")                  = 0
[   24.814071][  T397] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   24.836958][  T397] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   24.849670][  T397] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./9/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./9/file0")                      = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./9")                            = 0
mkdir("./10", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 401
./strace-static-x86_64: Process 401 attached
[pid   401] set_robust_list(0x5555573e4660, 24) = 0
[pid   401] chdir("./10")               = 0
[pid   401] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   401] setpgid(0, 0)               = 0
[pid   401] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   401] write(3, "1000", 4)         = 4
[pid   401] close(3)                    = 0
[pid   401] symlink("/dev/binderfs", "./binderfs") = 0
[pid   401] memfd_create("syzkaller", 0) = 3
[pid   401] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   401] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   401] munmap(0x7f8811023000, 1048576) = 0
[pid   401] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   401] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   401] close(3)                    = 0
[pid   401] mkdir("./file0", 0777)      = 0
[pid   401] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   401] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   401] chdir("./file0")            = 0
[pid   401] ioctl(4, LOOP_CLR_FD)       = 0
[pid   401] close(4)                    = 0
[pid   401] creat("./bus", 000)         = 4
[pid   401] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   401] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   401] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   401] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   401] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   401] exit_group(0)               = ?
[pid   401] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=401, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./10/binderfs")                 = 0
[   24.974205][  T401] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   24.997516][  T401] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   25.009811][  T401] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./10/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./10/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./10")                           = 0
mkdir("./11", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 405
./strace-static-x86_64: Process 405 attached
[pid   405] set_robust_list(0x5555573e4660, 24) = 0
[pid   405] chdir("./11")               = 0
[pid   405] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   405] setpgid(0, 0)               = 0
[pid   405] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   405] write(3, "1000", 4)         = 4
[pid   405] close(3)                    = 0
[pid   405] symlink("/dev/binderfs", "./binderfs") = 0
[pid   405] memfd_create("syzkaller", 0) = 3
[pid   405] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   405] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   405] munmap(0x7f8811023000, 1048576) = 0
[pid   405] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   405] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   405] close(3)                    = 0
[pid   405] mkdir("./file0", 0777)      = 0
[pid   405] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   405] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   405] chdir("./file0")            = 0
[pid   405] ioctl(4, LOOP_CLR_FD)       = 0
[pid   405] close(4)                    = 0
[pid   405] creat("./bus", 000)         = 4
[pid   405] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   405] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   405] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   405] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   405] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   405] exit_group(0)               = ?
[pid   405] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=405, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./11/binderfs")                 = 0
[   25.174043][  T405] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   25.195833][  T405] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   25.208290][  T405] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./11/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./11/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./11")                           = 0
mkdir("./12", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 409
./strace-static-x86_64: Process 409 attached
[pid   409] set_robust_list(0x5555573e4660, 24) = 0
[pid   409] chdir("./12")               = 0
[pid   409] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   409] setpgid(0, 0)               = 0
[pid   409] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   409] write(3, "1000", 4)         = 4
[pid   409] close(3)                    = 0
[pid   409] symlink("/dev/binderfs", "./binderfs") = 0
[pid   409] memfd_create("syzkaller", 0) = 3
[pid   409] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   409] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   409] munmap(0x7f8811023000, 1048576) = 0
[pid   409] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   409] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   409] close(3)                    = 0
[pid   409] mkdir("./file0", 0777)      = 0
[pid   409] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   409] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   409] chdir("./file0")            = 0
[pid   409] ioctl(4, LOOP_CLR_FD)       = 0
[pid   409] close(4)                    = 0
[pid   409] creat("./bus", 000)         = 4
[pid   409] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   409] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   409] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   409] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   409] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   409] exit_group(0)               = ?
[pid   409] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=409, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./12/binderfs")                 = 0
[   25.374494][  T409] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   25.396576][  T409] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   25.409185][  T409] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./12/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./12/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./12")                           = 0
mkdir("./13", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 413
./strace-static-x86_64: Process 413 attached
[pid   413] set_robust_list(0x5555573e4660, 24) = 0
[pid   413] chdir("./13")               = 0
[pid   413] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   413] setpgid(0, 0)               = 0
[pid   413] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   413] write(3, "1000", 4)         = 4
[pid   413] close(3)                    = 0
[pid   413] symlink("/dev/binderfs", "./binderfs") = 0
[pid   413] memfd_create("syzkaller", 0) = 3
[pid   413] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   413] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   413] munmap(0x7f8811023000, 1048576) = 0
[pid   413] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   413] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   413] close(3)                    = 0
[pid   413] mkdir("./file0", 0777)      = 0
[pid   413] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   413] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   413] chdir("./file0")            = 0
[pid   413] ioctl(4, LOOP_CLR_FD)       = 0
[pid   413] close(4)                    = 0
[pid   413] creat("./bus", 000)         = 4
[pid   413] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   413] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   413] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   413] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   413] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   413] exit_group(0)               = ?
[pid   413] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=413, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./13/binderfs")                 = 0
[   25.525195][  T413] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   25.547567][  T413] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   25.560252][  T413] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./13/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./13/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./13")                           = 0
mkdir("./14", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 418 attached
 <unfinished ...>
[pid   418] set_robust_list(0x5555573e4660, 24) = 0
[pid   418] chdir("./14")               = 0
[pid   418] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   418] setpgid(0, 0)               = 0
[pid   355] <... clone resumed>, child_tidptr=0x5555573e4650) = 418
[pid   418] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   418] write(3, "1000", 4)         = 4
[pid   418] close(3)                    = 0
[pid   418] symlink("/dev/binderfs", "./binderfs") = 0
[pid   418] memfd_create("syzkaller", 0) = 3
[pid   418] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   418] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   418] munmap(0x7f8811023000, 1048576) = 0
[pid   418] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   418] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   418] close(3)                    = 0
[pid   418] mkdir("./file0", 0777)      = 0
[pid   418] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   418] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   418] chdir("./file0")            = 0
[pid   418] ioctl(4, LOOP_CLR_FD)       = 0
[pid   418] close(4)                    = 0
[pid   418] creat("./bus", 000)         = 4
[pid   418] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   418] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   418] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   418] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   418] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   418] exit_group(0)               = ?
[pid   418] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=418, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./14/binderfs")                 = 0
[   25.694182][  T418] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   25.714199][  T418] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   25.726967][  T418] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./14/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./14/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./14")                           = 0
mkdir("./15", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 422
./strace-static-x86_64: Process 422 attached
[pid   422] set_robust_list(0x5555573e4660, 24) = 0
[pid   422] chdir("./15")               = 0
[pid   422] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   422] setpgid(0, 0)               = 0
[pid   422] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   422] write(3, "1000", 4)         = 4
[pid   422] close(3)                    = 0
[pid   422] symlink("/dev/binderfs", "./binderfs") = 0
[pid   422] memfd_create("syzkaller", 0) = 3
[pid   422] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   422] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   422] munmap(0x7f8811023000, 1048576) = 0
[pid   422] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   422] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   422] close(3)                    = 0
[pid   422] mkdir("./file0", 0777)      = 0
[pid   422] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   422] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   422] chdir("./file0")            = 0
[pid   422] ioctl(4, LOOP_CLR_FD)       = 0
[pid   422] close(4)                    = 0
[pid   422] creat("./bus", 000)         = 4
[pid   422] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   422] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   422] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   422] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   422] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[   25.834333][  T422] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   25.857706][  T422] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   25.870084][  T422] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
[pid   422] exit_group(0)               = ?
[pid   422] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=422, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./15", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./15/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./15/binderfs")                 = 0
umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./15/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./15/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./15/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./15")                           = 0
mkdir("./16", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 426
./strace-static-x86_64: Process 426 attached
[pid   426] set_robust_list(0x5555573e4660, 24) = 0
[pid   426] chdir("./16")               = 0
[pid   426] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   426] setpgid(0, 0)               = 0
[pid   426] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   426] write(3, "1000", 4)         = 4
[pid   426] close(3)                    = 0
[pid   426] symlink("/dev/binderfs", "./binderfs") = 0
[pid   426] memfd_create("syzkaller", 0) = 3
[pid   426] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   426] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   426] munmap(0x7f8811023000, 1048576) = 0
[pid   426] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   426] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   426] close(3)                    = 0
[pid   426] mkdir("./file0", 0777)      = 0
[pid   426] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   426] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   426] chdir("./file0")            = 0
[pid   426] ioctl(4, LOOP_CLR_FD)       = 0
[pid   426] close(4)                    = 0
[pid   426] creat("./bus", 000)         = 4
[pid   426] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   426] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   426] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   426] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   426] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   426] exit_group(0)               = ?
[pid   426] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=426, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
umount2("./16", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./16/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./16/binderfs")                 = 0
[   25.975176][  T426] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   25.994930][  T426] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   26.007231][  T426] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./16/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./16/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./16/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./16/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./16")                           = 0
mkdir("./17", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 430
./strace-static-x86_64: Process 430 attached
[pid   430] set_robust_list(0x5555573e4660, 24) = 0
[pid   430] chdir("./17")               = 0
[pid   430] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   430] setpgid(0, 0)               = 0
[pid   430] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   430] write(3, "1000", 4)         = 4
[pid   430] close(3)                    = 0
[pid   430] symlink("/dev/binderfs", "./binderfs") = 0
[pid   430] memfd_create("syzkaller", 0) = 3
[pid   430] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   430] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   430] munmap(0x7f8811023000, 1048576) = 0
[pid   430] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   430] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   430] close(3)                    = 0
[pid   430] mkdir("./file0", 0777)      = 0
[pid   430] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   430] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   430] chdir("./file0")            = 0
[pid   430] ioctl(4, LOOP_CLR_FD)       = 0
[pid   430] close(4)                    = 0
[pid   430] creat("./bus", 000)         = 4
[pid   430] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   430] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   430] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   430] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   430] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   430] exit_group(0)               = ?
[pid   430] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=430, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
umount2("./17", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./17/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./17/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./17/binderfs")                 = 0
[   26.114506][  T430] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   26.136211][  T430] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   26.148655][  T430] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./17/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./17/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./17/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./17/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./17")                           = 0
mkdir("./18", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 434
./strace-static-x86_64: Process 434 attached
[pid   434] set_robust_list(0x5555573e4660, 24) = 0
[pid   434] chdir("./18")               = 0
[pid   434] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   434] setpgid(0, 0)               = 0
[pid   434] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   434] write(3, "1000", 4)         = 4
[pid   434] close(3)                    = 0
[pid   434] symlink("/dev/binderfs", "./binderfs") = 0
[pid   434] memfd_create("syzkaller", 0) = 3
[pid   434] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   434] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   434] munmap(0x7f8811023000, 1048576) = 0
[pid   434] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   434] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   434] close(3)                    = 0
[pid   434] mkdir("./file0", 0777)      = 0
[pid   434] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   434] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   434] chdir("./file0")            = 0
[pid   434] ioctl(4, LOOP_CLR_FD)       = 0
[pid   434] close(4)                    = 0
[pid   434] creat("./bus", 000)         = 4
[pid   434] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   434] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   434] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   434] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   434] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   434] exit_group(0)               = ?
[pid   434] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=434, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./18", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./18/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./18/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./18/binderfs")                 = 0
[   26.254244][  T434] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   26.275935][  T434] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   26.288370][  T434] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./18/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./18/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./18/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./18/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./18")                           = 0
mkdir("./19", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 438 attached
 <unfinished ...>
[pid   438] set_robust_list(0x5555573e4660, 24 <unfinished ...>
[pid   355] <... clone resumed>, child_tidptr=0x5555573e4650) = 438
[pid   438] <... set_robust_list resumed>) = 0
[pid   438] chdir("./19")               = 0
[pid   438] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   438] setpgid(0, 0)               = 0
[pid   438] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   438] write(3, "1000", 4)         = 4
[pid   438] close(3)                    = 0
[pid   438] symlink("/dev/binderfs", "./binderfs") = 0
[pid   438] memfd_create("syzkaller", 0) = 3
[pid   438] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   438] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   438] munmap(0x7f8811023000, 1048576) = 0
[pid   438] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   438] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   438] close(3)                    = 0
[pid   438] mkdir("./file0", 0777)      = 0
[pid   438] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   438] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   438] chdir("./file0")            = 0
[pid   438] ioctl(4, LOOP_CLR_FD)       = 0
[pid   438] close(4)                    = 0
[pid   438] creat("./bus", 000)         = 4
[pid   438] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   438] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   438] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   438] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   438] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   438] exit_group(0)               = ?
[pid   438] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=438, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./19", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./19/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./19/binderfs")                 = 0
[   26.394202][  T438] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   26.416941][  T438] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   26.429784][  T438] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./19/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./19/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./19/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./19/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./19")                           = 0
mkdir("./20", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 442
./strace-static-x86_64: Process 442 attached
[pid   442] set_robust_list(0x5555573e4660, 24) = 0
[pid   442] chdir("./20")               = 0
[pid   442] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   442] setpgid(0, 0)               = 0
[pid   442] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   442] write(3, "1000", 4)         = 4
[pid   442] close(3)                    = 0
[pid   442] symlink("/dev/binderfs", "./binderfs") = 0
[pid   442] memfd_create("syzkaller", 0) = 3
[pid   442] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   442] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   442] munmap(0x7f8811023000, 1048576) = 0
[pid   442] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   442] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   442] close(3)                    = 0
[pid   442] mkdir("./file0", 0777)      = 0
[pid   442] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   442] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   442] chdir("./file0")            = 0
[pid   442] ioctl(4, LOOP_CLR_FD)       = 0
[pid   442] close(4)                    = 0
[pid   442] creat("./bus", 000)         = 4
[pid   442] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   442] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   442] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   442] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   442] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   442] exit_group(0)               = ?
[pid   442] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=442, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
umount2("./20", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./20/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./20/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./20/binderfs")                 = 0
[   26.524041][  T442] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   26.540997][  T442] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   26.553354][  T442] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./20/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./20/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./20/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./20/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./20")                           = 0
mkdir("./21", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 447
./strace-static-x86_64: Process 447 attached
[pid   447] set_robust_list(0x5555573e4660, 24) = 0
[pid   447] chdir("./21")               = 0
[pid   447] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   447] setpgid(0, 0)               = 0
[pid   447] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   447] write(3, "1000", 4)         = 4
[pid   447] close(3)                    = 0
[pid   447] symlink("/dev/binderfs", "./binderfs") = 0
[pid   447] memfd_create("syzkaller", 0) = 3
[pid   447] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   447] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   447] munmap(0x7f8811023000, 1048576) = 0
[pid   447] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   447] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   447] close(3)                    = 0
[pid   447] mkdir("./file0", 0777)      = 0
[pid   447] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   447] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   447] chdir("./file0")            = 0
[pid   447] ioctl(4, LOOP_CLR_FD)       = 0
[pid   447] close(4)                    = 0
[pid   447] creat("./bus", 000)         = 4
[pid   447] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   447] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   447] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   447] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   447] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   447] exit_group(0)               = ?
[pid   447] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=447, si_uid=0, si_status=0, si_utime=0, si_stime=5} ---
umount2("./21", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./21/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./21/binderfs")                 = 0
[   26.704236][  T447] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   26.724588][  T447] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   26.737314][  T447] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./21/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./21/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./21/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./21/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./21")                           = 0
mkdir("./22", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 451
./strace-static-x86_64: Process 451 attached
[pid   451] set_robust_list(0x5555573e4660, 24) = 0
[pid   451] chdir("./22")               = 0
[pid   451] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   451] setpgid(0, 0)               = 0
[pid   451] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   451] write(3, "1000", 4)         = 4
[pid   451] close(3)                    = 0
[pid   451] symlink("/dev/binderfs", "./binderfs") = 0
[pid   451] memfd_create("syzkaller", 0) = 3
[pid   451] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   451] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   451] munmap(0x7f8811023000, 1048576) = 0
[pid   451] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   451] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   451] close(3)                    = 0
[pid   451] mkdir("./file0", 0777)      = 0
[pid   451] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   451] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   451] chdir("./file0")            = 0
[pid   451] ioctl(4, LOOP_CLR_FD)       = 0
[pid   451] close(4)                    = 0
[pid   451] creat("./bus", 000)         = 4
[pid   451] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   451] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   451] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   451] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   451] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   451] exit_group(0)               = ?
[pid   451] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=451, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./22", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./22", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./22/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./22/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./22/binderfs")                 = 0
[   26.864090][  T451] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   26.887399][  T451] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   26.899777][  T451] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./22/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./22/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./22/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./22/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./22")                           = 0
mkdir("./23", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 455
./strace-static-x86_64: Process 455 attached
[pid   455] set_robust_list(0x5555573e4660, 24) = 0
[pid   455] chdir("./23")               = 0
[pid   455] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   455] setpgid(0, 0)               = 0
[pid   455] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   455] write(3, "1000", 4)         = 4
[pid   455] close(3)                    = 0
[pid   455] symlink("/dev/binderfs", "./binderfs") = 0
[pid   455] memfd_create("syzkaller", 0) = 3
[pid   455] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   455] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   455] munmap(0x7f8811023000, 1048576) = 0
[pid   455] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   455] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   455] close(3)                    = 0
[pid   455] mkdir("./file0", 0777)      = 0
[pid   455] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   455] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   455] chdir("./file0")            = 0
[pid   455] ioctl(4, LOOP_CLR_FD)       = 0
[pid   455] close(4)                    = 0
[pid   455] creat("./bus", 000)         = 4
[pid   455] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   455] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   455] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   455] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   455] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   455] exit_group(0)               = ?
[pid   455] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=455, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./23", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./23", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./23/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./23/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./23/binderfs")                 = 0
umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./23/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./23/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./23/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./23/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./23")                           = 0
mkdir("./24", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = 0
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 459
./strace-static-x86_64: Process 459 attached
[pid   459] set_robust_list(0x5555573e4660, 24) = 0
[pid   459] chdir("./24")               = 0
[pid   459] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   459] setpgid(0, 0)               = 0
[pid   459] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   459] write(3, "1000", 4)         = 4
[pid   459] close(3)                    = 0
[pid   459] symlink("/dev/binderfs", "./binderfs") = 0
[pid   459] memfd_create("syzkaller", 0) = 3
[pid   459] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   459] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   459] munmap(0x7f8811023000, 1048576) = 0
[   27.004639][  T455] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   27.026145][  T455] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   27.038527][  T455] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
[pid   459] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   459] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   459] close(3)                    = 0
[pid   459] mkdir("./file0", 0777)      = 0
[pid   459] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   459] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   459] chdir("./file0")            = 0
[pid   459] ioctl(4, LOOP_CLR_FD)       = 0
[pid   459] close(4)                    = 0
[pid   459] creat("./bus", 000)         = 4
[pid   459] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   459] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   459] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   459] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   27.124092][  T459] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   27.148037][  T459] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[pid   459] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   459] exit_group(0)               = ?
[pid   459] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=459, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./24", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./24", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./24/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./24/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./24/binderfs")                 = 0
[   27.160630][  T459] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./24/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./24/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./24/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./24/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./24")                           = 0
mkdir("./25", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 463
./strace-static-x86_64: Process 463 attached
[pid   463] set_robust_list(0x5555573e4660, 24) = 0
[pid   463] chdir("./25")               = 0
[pid   463] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   463] setpgid(0, 0)               = 0
[pid   463] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   463] write(3, "1000", 4)         = 4
[pid   463] close(3)                    = 0
[pid   463] symlink("/dev/binderfs", "./binderfs") = 0
[pid   463] memfd_create("syzkaller", 0) = 3
[pid   463] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   463] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   463] munmap(0x7f8811023000, 1048576) = 0
[pid   463] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   463] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   463] close(3)                    = 0
[pid   463] mkdir("./file0", 0777)      = 0
[pid   463] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   463] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   463] chdir("./file0")            = 0
[pid   463] ioctl(4, LOOP_CLR_FD)       = 0
[pid   463] close(4)                    = 0
[pid   463] creat("./bus", 000)         = 4
[pid   463] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   463] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   463] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   463] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   463] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   463] exit_group(0)               = ?
[pid   463] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=463, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./25", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./25", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./25/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./25/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./25/binderfs")                 = 0
[   27.274100][  T463] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   27.295702][  T463] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   27.308153][  T463] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./25/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./25/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./25/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./25/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./25")                           = 0
mkdir("./26", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 467
./strace-static-x86_64: Process 467 attached
[pid   467] set_robust_list(0x5555573e4660, 24) = 0
[pid   467] chdir("./26")               = 0
[pid   467] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   467] setpgid(0, 0)               = 0
[pid   467] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   467] write(3, "1000", 4)         = 4
[pid   467] close(3)                    = 0
[pid   467] symlink("/dev/binderfs", "./binderfs") = 0
[pid   467] memfd_create("syzkaller", 0) = 3
[pid   467] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   467] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   467] munmap(0x7f8811023000, 1048576) = 0
[pid   467] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   467] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   467] close(3)                    = 0
[pid   467] mkdir("./file0", 0777)      = 0
[pid   467] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   467] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   467] chdir("./file0")            = 0
[pid   467] ioctl(4, LOOP_CLR_FD)       = 0
[pid   467] close(4)                    = 0
[pid   467] creat("./bus", 000)         = 4
[pid   467] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   467] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   467] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   467] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   467] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   467] exit_group(0)               = ?
[pid   467] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=467, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
umount2("./26", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./26", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./26/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./26/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./26/binderfs")                 = 0
[   27.424608][  T467] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   27.441784][  T467] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   27.454136][  T467] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./26/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./26/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./26/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./26/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./26")                           = 0
mkdir("./27", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 472
./strace-static-x86_64: Process 472 attached
[pid   472] set_robust_list(0x5555573e4660, 24) = 0
[pid   472] chdir("./27")               = 0
[pid   472] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   472] setpgid(0, 0)               = 0
[pid   472] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   472] write(3, "1000", 4)         = 4
[pid   472] close(3)                    = 0
[pid   472] symlink("/dev/binderfs", "./binderfs") = 0
[pid   472] memfd_create("syzkaller", 0) = 3
[pid   472] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   472] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   472] munmap(0x7f8811023000, 1048576) = 0
[pid   472] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   472] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   472] close(3)                    = 0
[pid   472] mkdir("./file0", 0777)      = 0
[pid   472] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   472] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   472] chdir("./file0")            = 0
[pid   472] ioctl(4, LOOP_CLR_FD)       = 0
[pid   472] close(4)                    = 0
[pid   472] creat("./bus", 000)         = 4
[pid   472] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   472] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   472] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   472] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   27.654245][  T472] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   27.678973][  T472] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[pid   472] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   472] exit_group(0)               = ?
[pid   472] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=472, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./27", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./27", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./27/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./27/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./27/binderfs")                 = 0
[   27.691370][  T472] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./27/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./27/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./27/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./27/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./27")                           = 0
mkdir("./28", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 476
./strace-static-x86_64: Process 476 attached
[pid   476] set_robust_list(0x5555573e4660, 24) = 0
[pid   476] chdir("./28")               = 0
[pid   476] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   476] setpgid(0, 0)               = 0
[pid   476] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   476] write(3, "1000", 4)         = 4
[pid   476] close(3)                    = 0
[pid   476] symlink("/dev/binderfs", "./binderfs") = 0
[pid   476] memfd_create("syzkaller", 0) = 3
[pid   476] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   476] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   476] munmap(0x7f8811023000, 1048576) = 0
[pid   476] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   476] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   476] close(3)                    = 0
[pid   476] mkdir("./file0", 0777)      = 0
[pid   476] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   476] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   476] chdir("./file0")            = 0
[pid   476] ioctl(4, LOOP_CLR_FD)       = 0
[pid   476] close(4)                    = 0
[pid   476] creat("./bus", 000)         = 4
[pid   476] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   476] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   476] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   476] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   476] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   476] exit_group(0)               = ?
[pid   476] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=476, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./28", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./28", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./28/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./28/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./28/binderfs")                 = 0
[   27.784227][  T476] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   27.804112][  T476] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   27.816688][  T476] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./28/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./28/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./28/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./28/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./28")                           = 0
mkdir("./29", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 480
./strace-static-x86_64: Process 480 attached
[pid   480] set_robust_list(0x5555573e4660, 24) = 0
[pid   480] chdir("./29")               = 0
[pid   480] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   480] setpgid(0, 0)               = 0
[pid   480] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   480] write(3, "1000", 4)         = 4
[pid   480] close(3)                    = 0
[pid   480] symlink("/dev/binderfs", "./binderfs") = 0
[pid   480] memfd_create("syzkaller", 0) = 3
[pid   480] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   480] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   480] munmap(0x7f8811023000, 1048576) = 0
[pid   480] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   480] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   480] close(3)                    = 0
[pid   480] mkdir("./file0", 0777)      = 0
[pid   480] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   480] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   480] chdir("./file0")            = 0
[pid   480] ioctl(4, LOOP_CLR_FD)       = 0
[pid   480] close(4)                    = 0
[pid   480] creat("./bus", 000)         = 4
[pid   480] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   480] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   480] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   480] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   27.975792][  T480] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   27.999232][  T480] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   28.011557][  T480] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
[pid   480] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   480] exit_group(0)               = ?
[pid   480] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=480, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./29", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./29", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./29/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./29/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./29/binderfs")                 = 0
umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./29/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./29/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./29/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./29/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./29")                           = 0
mkdir("./30", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 484
./strace-static-x86_64: Process 484 attached
[pid   484] set_robust_list(0x5555573e4660, 24) = 0
[pid   484] chdir("./30")               = 0
[pid   484] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   484] setpgid(0, 0)               = 0
[pid   484] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   484] write(3, "1000", 4)         = 4
[pid   484] close(3)                    = 0
[pid   484] symlink("/dev/binderfs", "./binderfs") = 0
[pid   484] memfd_create("syzkaller", 0) = 3
[pid   484] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   484] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   484] munmap(0x7f8811023000, 1048576) = 0
[pid   484] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   484] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   484] close(3)                    = 0
[pid   484] mkdir("./file0", 0777)      = 0
[pid   484] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   484] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   484] chdir("./file0")            = 0
[pid   484] ioctl(4, LOOP_CLR_FD)       = 0
[pid   484] close(4)                    = 0
[pid   484] creat("./bus", 000)         = 4
[pid   484] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   484] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   484] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   484] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   484] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   484] exit_group(0)               = ?
[pid   484] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=484, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./30", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./30", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./30/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./30/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./30/binderfs")                 = 0
[   28.104262][  T484] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   28.125948][  T484] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   28.138505][  T484] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./30/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./30/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./30/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./30/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./30")                           = 0
mkdir("./31", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 488
./strace-static-x86_64: Process 488 attached
[pid   488] set_robust_list(0x5555573e4660, 24) = 0
[pid   488] chdir("./31")               = 0
[pid   488] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   488] setpgid(0, 0)               = 0
[pid   488] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   488] write(3, "1000", 4)         = 4
[pid   488] close(3)                    = 0
[pid   488] symlink("/dev/binderfs", "./binderfs") = 0
[pid   488] memfd_create("syzkaller", 0) = 3
[pid   488] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   488] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   488] munmap(0x7f8811023000, 1048576) = 0
[pid   488] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   488] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   488] close(3)                    = 0
[pid   488] mkdir("./file0", 0777)      = 0
[pid   488] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   488] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   488] chdir("./file0")            = 0
[pid   488] ioctl(4, LOOP_CLR_FD)       = 0
[pid   488] close(4)                    = 0
[pid   488] creat("./bus", 000)         = 4
[pid   488] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   488] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   488] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   488] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   28.314341][  T488] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   28.337693][  T488] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   28.350210][  T488] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
[pid   488] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   488] exit_group(0)               = ?
[pid   488] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=488, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./31", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./31", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./31/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./31/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./31/binderfs")                 = 0
umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./31/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./31/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./31/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./31/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./31")                           = 0
mkdir("./32", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 492
./strace-static-x86_64: Process 492 attached
[pid   492] set_robust_list(0x5555573e4660, 24) = 0
[pid   492] chdir("./32")               = 0
[pid   492] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   492] setpgid(0, 0)               = 0
[pid   492] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   492] write(3, "1000", 4)         = 4
[pid   492] close(3)                    = 0
[pid   492] symlink("/dev/binderfs", "./binderfs") = 0
[pid   492] memfd_create("syzkaller", 0) = 3
[pid   492] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   492] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   492] munmap(0x7f8811023000, 1048576) = 0
[pid   492] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   492] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   492] close(3)                    = 0
[pid   492] mkdir("./file0", 0777)      = 0
[pid   492] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   492] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   492] chdir("./file0")            = 0
[pid   492] ioctl(4, LOOP_CLR_FD)       = 0
[pid   492] close(4)                    = 0
[pid   492] creat("./bus", 000)         = 4
[pid   492] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   492] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   492] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   492] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   492] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   492] exit_group(0)               = ?
[pid   492] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=492, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./32", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./32", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./32/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./32/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./32/binderfs")                 = 0
[   28.444429][  T492] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   28.466713][  T492] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   28.479157][  T492] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./32/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./32/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./32/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./32/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./32")                           = 0
mkdir("./33", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 497
./strace-static-x86_64: Process 497 attached
[pid   497] set_robust_list(0x5555573e4660, 24) = 0
[pid   497] chdir("./33")               = 0
[pid   497] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   497] setpgid(0, 0)               = 0
[pid   497] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   497] write(3, "1000", 4)         = 4
[pid   497] close(3)                    = 0
[pid   497] symlink("/dev/binderfs", "./binderfs") = 0
[pid   497] memfd_create("syzkaller", 0) = 3
[pid   497] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   497] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   497] munmap(0x7f8811023000, 1048576) = 0
[pid   497] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   497] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   497] close(3)                    = 0
[pid   497] mkdir("./file0", 0777)      = 0
[pid   497] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   497] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   497] chdir("./file0")            = 0
[pid   497] ioctl(4, LOOP_CLR_FD)       = 0
[pid   497] close(4)                    = 0
[pid   497] creat("./bus", 000)         = 4
[pid   497] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   497] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   497] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   497] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   28.654179][  T497] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   28.679122][  T497] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[pid   497] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   497] exit_group(0)               = ?
[pid   497] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=497, si_uid=0, si_status=0, si_utime=1, si_stime=2} ---
umount2("./33", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./33", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./33/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./33/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./33/binderfs")                 = 0
[   28.691997][  T497] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./33/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./33/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./33/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./33/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./33")                           = 0
mkdir("./34", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 501
./strace-static-x86_64: Process 501 attached
[pid   501] set_robust_list(0x5555573e4660, 24) = 0
[pid   501] chdir("./34")               = 0
[pid   501] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   501] setpgid(0, 0)               = 0
[pid   501] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   501] write(3, "1000", 4)         = 4
[pid   501] close(3)                    = 0
[pid   501] symlink("/dev/binderfs", "./binderfs") = 0
[pid   501] memfd_create("syzkaller", 0) = 3
[pid   501] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   501] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   501] munmap(0x7f8811023000, 1048576) = 0
[pid   501] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   501] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   501] close(3)                    = 0
[pid   501] mkdir("./file0", 0777)      = 0
[pid   501] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   501] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   501] chdir("./file0")            = 0
[pid   501] ioctl(4, LOOP_CLR_FD)       = 0
[pid   501] close(4)                    = 0
[pid   501] creat("./bus", 000)         = 4
[pid   501] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   501] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   501] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   501] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   501] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   501] exit_group(0)               = ?
[pid   501] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=501, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./34", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./34", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./34/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./34/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./34/binderfs")                 = 0
[   28.845682][  T501] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   28.867346][  T501] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   28.879748][  T501] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./34/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./34/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./34/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./34/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./34")                           = 0
mkdir("./35", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 505
./strace-static-x86_64: Process 505 attached
[pid   505] set_robust_list(0x5555573e4660, 24) = 0
[pid   505] chdir("./35")               = 0
[pid   505] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   505] setpgid(0, 0)               = 0
[pid   505] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   505] write(3, "1000", 4)         = 4
[pid   505] close(3)                    = 0
[pid   505] symlink("/dev/binderfs", "./binderfs") = 0
[pid   505] memfd_create("syzkaller", 0) = 3
[pid   505] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   505] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   505] munmap(0x7f8811023000, 1048576) = 0
[pid   505] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   505] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   505] close(3)                    = 0
[pid   505] mkdir("./file0", 0777)      = 0
[pid   505] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   505] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   505] chdir("./file0")            = 0
[pid   505] ioctl(4, LOOP_CLR_FD)       = 0
[pid   505] close(4)                    = 0
[pid   505] creat("./bus", 000)         = 4
[pid   505] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   505] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   505] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   505] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   505] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   505] exit_group(0)               = ?
[pid   505] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=505, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./35", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./35", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./35/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./35/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./35/binderfs")                 = 0
[   28.974118][  T505] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   28.989983][  T505] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   29.002456][  T505] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./35/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./35/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./35/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./35/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./35")                           = 0
mkdir("./36", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 509
./strace-static-x86_64: Process 509 attached
[pid   509] set_robust_list(0x5555573e4660, 24) = 0
[pid   509] chdir("./36")               = 0
[pid   509] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   509] setpgid(0, 0)               = 0
[pid   509] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   509] write(3, "1000", 4)         = 4
[pid   509] close(3)                    = 0
[pid   509] symlink("/dev/binderfs", "./binderfs") = 0
[pid   509] memfd_create("syzkaller", 0) = 3
[pid   509] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   509] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   509] munmap(0x7f8811023000, 1048576) = 0
[pid   509] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   509] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   509] close(3)                    = 0
[pid   509] mkdir("./file0", 0777)      = 0
[pid   509] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   509] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   509] chdir("./file0")            = 0
[pid   509] ioctl(4, LOOP_CLR_FD)       = 0
[pid   509] close(4)                    = 0
[pid   509] creat("./bus", 000)         = 4
[pid   509] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   509] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   509] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   509] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   509] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   509] exit_group(0)               = ?
[pid   509] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=509, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./36", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./36", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./36/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./36/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./36/binderfs")                 = 0
[   29.104122][  T509] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   29.125739][  T509] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   29.138077][  T509] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./36/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./36/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./36/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./36/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./36")                           = 0
mkdir("./37", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 513
./strace-static-x86_64: Process 513 attached
[pid   513] set_robust_list(0x5555573e4660, 24) = 0
[pid   513] chdir("./37")               = 0
[pid   513] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   513] setpgid(0, 0)               = 0
[pid   513] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   513] write(3, "1000", 4)         = 4
[pid   513] close(3)                    = 0
[pid   513] symlink("/dev/binderfs", "./binderfs") = 0
[pid   513] memfd_create("syzkaller", 0) = 3
[pid   513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   513] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   513] munmap(0x7f8811023000, 1048576) = 0
[pid   513] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   513] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   513] close(3)                    = 0
[pid   513] mkdir("./file0", 0777)      = 0
[pid   513] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   513] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   513] chdir("./file0")            = 0
[pid   513] ioctl(4, LOOP_CLR_FD)       = 0
[pid   513] close(4)                    = 0
[pid   513] creat("./bus", 000)         = 4
[pid   513] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   513] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   513] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   513] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   513] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   513] exit_group(0)               = ?
[pid   513] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=513, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./37", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./37", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./37/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./37/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./37/binderfs")                 = 0
[   29.244216][  T513] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   29.267352][  T513] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   29.279671][  T513] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./37/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./37/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./37/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./37/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./37")                           = 0
mkdir("./38", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 517
./strace-static-x86_64: Process 517 attached
[pid   517] set_robust_list(0x5555573e4660, 24) = 0
[pid   517] chdir("./38")               = 0
[pid   517] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   517] setpgid(0, 0)               = 0
[pid   517] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   517] write(3, "1000", 4)         = 4
[pid   517] close(3)                    = 0
[pid   517] symlink("/dev/binderfs", "./binderfs") = 0
[pid   517] memfd_create("syzkaller", 0) = 3
[pid   517] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   517] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   517] munmap(0x7f8811023000, 1048576) = 0
[pid   517] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   517] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   517] close(3)                    = 0
[pid   517] mkdir("./file0", 0777)      = 0
[pid   517] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   517] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   517] chdir("./file0")            = 0
[pid   517] ioctl(4, LOOP_CLR_FD)       = 0
[pid   517] close(4)                    = 0
[pid   517] creat("./bus", 000)         = 4
[pid   517] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   517] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   517] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   517] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   517] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   517] exit_group(0)               = ?
[pid   517] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=517, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./38", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./38", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./38/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./38/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./38/binderfs")                 = 0
[   29.414139][  T517] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   29.430556][  T517] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   29.443091][  T517] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./38/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./38/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./38/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./38/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./38")                           = 0
mkdir("./39", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 521
./strace-static-x86_64: Process 521 attached
[pid   521] set_robust_list(0x5555573e4660, 24) = 0
[pid   521] chdir("./39")               = 0
[pid   521] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   521] setpgid(0, 0)               = 0
[pid   521] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   521] write(3, "1000", 4)         = 4
[pid   521] close(3)                    = 0
[pid   521] symlink("/dev/binderfs", "./binderfs") = 0
[pid   521] memfd_create("syzkaller", 0) = 3
[pid   521] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   521] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   521] munmap(0x7f8811023000, 1048576) = 0
[pid   521] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   521] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   521] close(3)                    = 0
[pid   521] mkdir("./file0", 0777)      = 0
[pid   521] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   521] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   521] chdir("./file0")            = 0
[pid   521] ioctl(4, LOOP_CLR_FD)       = 0
[pid   521] close(4)                    = 0
[pid   521] creat("./bus", 000)         = 4
[pid   521] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   521] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   521] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   521] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   521] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   521] exit_group(0)               = ?
[pid   521] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=521, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
umount2("./39", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./39", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./39/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./39/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./39/binderfs")                 = 0
[   29.584216][  T521] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   29.606998][  T521] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   29.619386][  T521] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./39/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./39/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./39/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./39/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./39")                           = 0
mkdir("./40", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 526
./strace-static-x86_64: Process 526 attached
[pid   526] set_robust_list(0x5555573e4660, 24) = 0
[pid   526] chdir("./40")               = 0
[pid   526] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   526] setpgid(0, 0)               = 0
[pid   526] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   526] write(3, "1000", 4)         = 4
[pid   526] close(3)                    = 0
[pid   526] symlink("/dev/binderfs", "./binderfs") = 0
[pid   526] memfd_create("syzkaller", 0) = 3
[pid   526] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   526] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   526] munmap(0x7f8811023000, 1048576) = 0
[pid   526] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   526] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   526] close(3)                    = 0
[pid   526] mkdir("./file0", 0777)      = 0
[pid   526] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   526] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   526] chdir("./file0")            = 0
[pid   526] ioctl(4, LOOP_CLR_FD)       = 0
[pid   526] close(4)                    = 0
[pid   526] creat("./bus", 000)         = 4
[pid   526] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   526] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   526] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   526] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   29.784417][  T526] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   29.810741][  T526] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[pid   526] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   526] exit_group(0)               = ?
[pid   526] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=526, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./40", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./40", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./40/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./40/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./40/binderfs")                 = 0
[   29.823192][  T526] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./40/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./40/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./40/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./40/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./40")                           = 0
mkdir("./41", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 530
./strace-static-x86_64: Process 530 attached
[pid   530] set_robust_list(0x5555573e4660, 24) = 0
[pid   530] chdir("./41")               = 0
[pid   530] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   530] setpgid(0, 0)               = 0
[pid   530] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   530] write(3, "1000", 4)         = 4
[pid   530] close(3)                    = 0
[pid   530] symlink("/dev/binderfs", "./binderfs") = 0
[pid   530] memfd_create("syzkaller", 0) = 3
[pid   530] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   530] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   530] munmap(0x7f8811023000, 1048576) = 0
[pid   530] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   530] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   530] close(3)                    = 0
[pid   530] mkdir("./file0", 0777)      = 0
[pid   530] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   530] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   530] chdir("./file0")            = 0
[pid   530] ioctl(4, LOOP_CLR_FD)       = 0
[pid   530] close(4)                    = 0
[pid   530] creat("./bus", 000)         = 4
[pid   530] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   530] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   530] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   530] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   530] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   530] exit_group(0)               = ?
[pid   530] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=530, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./41", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./41", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./41/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./41/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./41/binderfs")                 = 0
[   29.944367][  T530] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   29.964253][  T530] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   29.976603][  T530] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./41/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./41/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./41/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./41/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./41")                           = 0
mkdir("./42", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 534
./strace-static-x86_64: Process 534 attached
[pid   534] set_robust_list(0x5555573e4660, 24) = 0
[pid   534] chdir("./42")               = 0
[pid   534] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   534] setpgid(0, 0)               = 0
[pid   534] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   534] write(3, "1000", 4)         = 4
[pid   534] close(3)                    = 0
[pid   534] symlink("/dev/binderfs", "./binderfs") = 0
[pid   534] memfd_create("syzkaller", 0) = 3
[pid   534] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   534] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   534] munmap(0x7f8811023000, 1048576) = 0
[pid   534] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   534] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   534] close(3)                    = 0
[pid   534] mkdir("./file0", 0777)      = 0
[pid   534] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   534] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   534] chdir("./file0")            = 0
[pid   534] ioctl(4, LOOP_CLR_FD)       = 0
[pid   534] close(4)                    = 0
[pid   534] creat("./bus", 000)         = 4
[pid   534] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   534] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   534] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   534] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   534] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   534] exit_group(0)               = ?
[pid   534] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=534, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./42", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./42", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./42/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./42/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./42/binderfs")                 = 0
[   30.133985][  T534] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   30.151252][  T534] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   30.163580][  T534] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./42/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./42/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./42/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./42/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./42")                           = 0
mkdir("./43", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 538
./strace-static-x86_64: Process 538 attached
[pid   538] set_robust_list(0x5555573e4660, 24) = 0
[pid   538] chdir("./43")               = 0
[pid   538] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   538] setpgid(0, 0)               = 0
[pid   538] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   538] write(3, "1000", 4)         = 4
[pid   538] close(3)                    = 0
[pid   538] symlink("/dev/binderfs", "./binderfs") = 0
[pid   538] memfd_create("syzkaller", 0) = 3
[pid   538] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   538] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   538] munmap(0x7f8811023000, 1048576) = 0
[pid   538] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   538] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   538] close(3)                    = 0
[pid   538] mkdir("./file0", 0777)      = 0
[pid   538] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   538] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   538] chdir("./file0")            = 0
[pid   538] ioctl(4, LOOP_CLR_FD)       = 0
[pid   538] close(4)                    = 0
[pid   538] creat("./bus", 000)         = 4
[pid   538] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   538] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   538] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   538] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   538] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   538] exit_group(0)               = ?
[pid   538] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=538, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./43", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./43", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./43/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./43/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./43/binderfs")                 = 0
[   30.304148][  T538] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   30.324859][  T538] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   30.337506][  T538] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./43/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./43/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./43/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./43/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./43")                           = 0
mkdir("./44", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 542
./strace-static-x86_64: Process 542 attached
[pid   542] set_robust_list(0x5555573e4660, 24) = 0
[pid   542] chdir("./44")               = 0
[pid   542] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   542] setpgid(0, 0)               = 0
[pid   542] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   542] write(3, "1000", 4)         = 4
[pid   542] close(3)                    = 0
[pid   542] symlink("/dev/binderfs", "./binderfs") = 0
[pid   542] memfd_create("syzkaller", 0) = 3
[pid   542] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   542] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   542] munmap(0x7f8811023000, 1048576) = 0
[pid   542] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   542] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   542] close(3)                    = 0
[pid   542] mkdir("./file0", 0777)      = 0
[pid   542] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   542] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   542] chdir("./file0")            = 0
[pid   542] ioctl(4, LOOP_CLR_FD)       = 0
[pid   542] close(4)                    = 0
[pid   542] creat("./bus", 000)         = 4
[pid   542] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   542] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   542] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   542] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   542] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   542] exit_group(0)               = ?
[pid   542] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=542, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./44", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./44", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./44/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./44/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./44/binderfs")                 = 0
umount2("./44/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./44/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./44/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./44/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./44/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./44/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./44")                           = 0
mkdir("./45", 0777)                     = 0
[   30.494181][  T542] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   30.515886][  T542] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   30.528333][  T542] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 547
./strace-static-x86_64: Process 547 attached
[pid   547] set_robust_list(0x5555573e4660, 24) = 0
[pid   547] chdir("./45")               = 0
[pid   547] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   547] setpgid(0, 0)               = 0
[pid   547] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   547] write(3, "1000", 4)         = 4
[pid   547] close(3)                    = 0
[pid   547] symlink("/dev/binderfs", "./binderfs") = 0
[pid   547] memfd_create("syzkaller", 0) = 3
[pid   547] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   547] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   547] munmap(0x7f8811023000, 1048576) = 0
[pid   547] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   547] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   547] close(3)                    = 0
[pid   547] mkdir("./file0", 0777)      = 0
[pid   547] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   547] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   547] chdir("./file0")            = 0
[pid   547] ioctl(4, LOOP_CLR_FD)       = 0
[pid   547] close(4)                    = 0
[pid   547] creat("./bus", 000)         = 4
[pid   547] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   547] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   547] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   547] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   30.644490][  T547] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   30.668125][  T547] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[pid   547] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   547] exit_group(0)               = ?
[pid   547] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=547, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
umount2("./45", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./45", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./45/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./45/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./45/binderfs")                 = 0
[   30.680507][  T547] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./45/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./45/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./45/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./45/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./45/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./45/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./45")                           = 0
mkdir("./46", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 551
./strace-static-x86_64: Process 551 attached
[pid   551] set_robust_list(0x5555573e4660, 24) = 0
[pid   551] chdir("./46")               = 0
[pid   551] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   551] setpgid(0, 0)               = 0
[pid   551] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   551] write(3, "1000", 4)         = 4
[pid   551] close(3)                    = 0
[pid   551] symlink("/dev/binderfs", "./binderfs") = 0
[pid   551] memfd_create("syzkaller", 0) = 3
[pid   551] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   551] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   551] munmap(0x7f8811023000, 1048576) = 0
[pid   551] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   551] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   551] close(3)                    = 0
[pid   551] mkdir("./file0", 0777)      = 0
[pid   551] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   551] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   551] chdir("./file0")            = 0
[pid   551] ioctl(4, LOOP_CLR_FD)       = 0
[pid   551] close(4)                    = 0
[pid   551] creat("./bus", 000)         = 4
[pid   551] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   551] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   551] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   551] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   551] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   551] exit_group(0)               = ?
[pid   551] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=551, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./46", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./46", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./46/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./46/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./46/binderfs")                 = 0
[   30.774241][  T551] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   30.790451][  T551] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   30.803270][  T551] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./46/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./46/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./46/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./46/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./46/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./46/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./46")                           = 0
mkdir("./47", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 555
./strace-static-x86_64: Process 555 attached
[pid   555] set_robust_list(0x5555573e4660, 24) = 0
[pid   555] chdir("./47")               = 0
[pid   555] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   555] setpgid(0, 0)               = 0
[pid   555] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   555] write(3, "1000", 4)         = 4
[pid   555] close(3)                    = 0
[pid   555] symlink("/dev/binderfs", "./binderfs") = 0
[pid   555] memfd_create("syzkaller", 0) = 3
[pid   555] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   555] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   555] munmap(0x7f8811023000, 1048576) = 0
[pid   555] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   555] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   555] close(3)                    = 0
[pid   555] mkdir("./file0", 0777)      = 0
[pid   555] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   555] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   555] chdir("./file0")            = 0
[pid   555] ioctl(4, LOOP_CLR_FD)       = 0
[pid   555] close(4)                    = 0
[pid   555] creat("./bus", 000)         = 4
[pid   555] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   555] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   555] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   555] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   555] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   555] exit_group(0)               = ?
[pid   555] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=555, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./47", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./47", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./47/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./47/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./47/binderfs")                 = 0
[   30.924227][  T555] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   30.945555][  T555] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   30.958230][  T555] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./47/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./47/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./47/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./47/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./47/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./47/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./47")                           = 0
mkdir("./48", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 559
./strace-static-x86_64: Process 559 attached
[pid   559] set_robust_list(0x5555573e4660, 24) = 0
[pid   559] chdir("./48")               = 0
[pid   559] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   559] setpgid(0, 0)               = 0
[pid   559] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   559] write(3, "1000", 4)         = 4
[pid   559] close(3)                    = 0
[pid   559] symlink("/dev/binderfs", "./binderfs") = 0
[pid   559] memfd_create("syzkaller", 0) = 3
[pid   559] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   559] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   559] munmap(0x7f8811023000, 1048576) = 0
[pid   559] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   559] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   559] close(3)                    = 0
[pid   559] mkdir("./file0", 0777)      = 0
[pid   559] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   559] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   559] chdir("./file0")            = 0
[pid   559] ioctl(4, LOOP_CLR_FD)       = 0
[pid   559] close(4)                    = 0
[pid   559] creat("./bus", 000)         = 4
[pid   559] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   559] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   559] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   559] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   559] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   559] exit_group(0)               = ?
[pid   559] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=559, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./48", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./48", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./48/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./48/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./48/binderfs")                 = 0
[   31.084451][  T559] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   31.101819][  T559] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   31.114194][  T559] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./48/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./48/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./48/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./48/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./48/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./48/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./48")                           = 0
mkdir("./49", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 563
./strace-static-x86_64: Process 563 attached
[pid   563] set_robust_list(0x5555573e4660, 24) = 0
[pid   563] chdir("./49")               = 0
[pid   563] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   563] setpgid(0, 0)               = 0
[pid   563] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   563] write(3, "1000", 4)         = 4
[pid   563] close(3)                    = 0
[pid   563] symlink("/dev/binderfs", "./binderfs") = 0
[pid   563] memfd_create("syzkaller", 0) = 3
[pid   563] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   563] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   563] munmap(0x7f8811023000, 1048576) = 0
[pid   563] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   563] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   563] close(3)                    = 0
[pid   563] mkdir("./file0", 0777)      = 0
[pid   563] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   563] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   563] chdir("./file0")            = 0
[pid   563] ioctl(4, LOOP_CLR_FD)       = 0
[pid   563] close(4)                    = 0
[pid   563] creat("./bus", 000)         = 4
[pid   563] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   563] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   563] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   563] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   563] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   563] exit_group(0)               = ?
[pid   563] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=563, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./49", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./49", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./49/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./49/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./49/binderfs")                 = 0
[   31.204279][  T563] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   31.226987][  T563] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   31.239443][  T563] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./49/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./49/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./49/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./49/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./49/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./49/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./49")                           = 0
mkdir("./50", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 567
./strace-static-x86_64: Process 567 attached
[pid   567] set_robust_list(0x5555573e4660, 24) = 0
[pid   567] chdir("./50")               = 0
[pid   567] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   567] setpgid(0, 0)               = 0
[pid   567] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   567] write(3, "1000", 4)         = 4
[pid   567] close(3)                    = 0
[pid   567] symlink("/dev/binderfs", "./binderfs") = 0
[pid   567] memfd_create("syzkaller", 0) = 3
[pid   567] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   567] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   567] munmap(0x7f8811023000, 1048576) = 0
[pid   567] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   567] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   567] close(3)                    = 0
[pid   567] mkdir("./file0", 0777)      = 0
[pid   567] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   567] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   567] chdir("./file0")            = 0
[pid   567] ioctl(4, LOOP_CLR_FD)       = 0
[pid   567] close(4)                    = 0
[pid   567] creat("./bus", 000)         = 4
[pid   567] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   567] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   567] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   567] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   567] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   567] exit_group(0)               = ?
[pid   567] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=567, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./50", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./50", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./50/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./50/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./50/binderfs")                 = 0
[   31.374123][  T567] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   31.396102][  T567] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   31.408734][  T567] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./50/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./50/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./50/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./50/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./50/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./50/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./50")                           = 0
mkdir("./51", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 571
./strace-static-x86_64: Process 571 attached
[pid   571] set_robust_list(0x5555573e4660, 24) = 0
[pid   571] chdir("./51")               = 0
[pid   571] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   571] setpgid(0, 0)               = 0
[pid   571] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   571] write(3, "1000", 4)         = 4
[pid   571] close(3)                    = 0
[pid   571] symlink("/dev/binderfs", "./binderfs") = 0
[pid   571] memfd_create("syzkaller", 0) = 3
[pid   571] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   571] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   571] munmap(0x7f8811023000, 1048576) = 0
[pid   571] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   571] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   571] close(3)                    = 0
[pid   571] mkdir("./file0", 0777)      = 0
[pid   571] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   571] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   571] chdir("./file0")            = 0
[pid   571] ioctl(4, LOOP_CLR_FD)       = 0
[pid   571] close(4)                    = 0
[pid   571] creat("./bus", 000)         = 4
[pid   571] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   571] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   571] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   571] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   571] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   571] exit_group(0)               = ?
[pid   571] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=571, si_uid=0, si_status=0, si_utime=0, si_stime=6} ---
umount2("./51", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./51", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./51/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./51/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./51/binderfs")                 = 0
[   31.514278][  T571] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   31.533836][  T571] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   31.546400][  T571] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./51/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./51/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./51/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./51/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./51/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./51/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./51")                           = 0
mkdir("./52", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 576
./strace-static-x86_64: Process 576 attached
[pid   576] set_robust_list(0x5555573e4660, 24) = 0
[pid   576] chdir("./52")               = 0
[pid   576] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   576] setpgid(0, 0)               = 0
[pid   576] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   576] write(3, "1000", 4)         = 4
[pid   576] close(3)                    = 0
[pid   576] symlink("/dev/binderfs", "./binderfs") = 0
[pid   576] memfd_create("syzkaller", 0) = 3
[pid   576] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   576] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   576] munmap(0x7f8811023000, 1048576) = 0
[pid   576] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   576] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   576] close(3)                    = 0
[pid   576] mkdir("./file0", 0777)      = 0
[pid   576] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   576] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   576] chdir("./file0")            = 0
[pid   576] ioctl(4, LOOP_CLR_FD)       = 0
[pid   576] close(4)                    = 0
[pid   576] creat("./bus", 000)         = 4
[pid   576] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   576] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   576] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   576] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   576] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   576] exit_group(0)               = ?
[pid   576] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=576, si_uid=0, si_status=0, si_utime=1, si_stime=3} ---
umount2("./52", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./52", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./52/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./52/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./52/binderfs")                 = 0
[   31.714369][  T576] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   31.736567][  T576] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   31.749023][  T576] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./52/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./52/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./52/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./52/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./52/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./52/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./52")                           = 0
mkdir("./53", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 580
./strace-static-x86_64: Process 580 attached
[pid   580] set_robust_list(0x5555573e4660, 24) = 0
[pid   580] chdir("./53")               = 0
[pid   580] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   580] setpgid(0, 0)               = 0
[pid   580] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   580] write(3, "1000", 4)         = 4
[pid   580] close(3)                    = 0
[pid   580] symlink("/dev/binderfs", "./binderfs") = 0
[pid   580] memfd_create("syzkaller", 0) = 3
[pid   580] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   580] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   580] munmap(0x7f8811023000, 1048576) = 0
[pid   580] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   580] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   580] close(3)                    = 0
[pid   580] mkdir("./file0", 0777)      = 0
[pid   580] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   580] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   580] chdir("./file0")            = 0
[pid   580] ioctl(4, LOOP_CLR_FD)       = 0
[pid   580] close(4)                    = 0
[pid   580] creat("./bus", 000)         = 4
[pid   580] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   580] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   580] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   580] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   580] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   580] exit_group(0)               = ?
[pid   580] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=580, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
umount2("./53", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./53", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./53/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./53/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./53/binderfs")                 = 0
[   31.854221][  T580] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   31.875170][  T580] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   31.887658][  T580] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./53/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./53/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./53/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./53/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./53/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./53/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./53")                           = 0
mkdir("./54", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 584
./strace-static-x86_64: Process 584 attached
[pid   584] set_robust_list(0x5555573e4660, 24) = 0
[pid   584] chdir("./54")               = 0
[pid   584] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   584] setpgid(0, 0)               = 0
[pid   584] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   584] write(3, "1000", 4)         = 4
[pid   584] close(3)                    = 0
[pid   584] symlink("/dev/binderfs", "./binderfs") = 0
[pid   584] memfd_create("syzkaller", 0) = 3
[pid   584] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   584] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   584] munmap(0x7f8811023000, 1048576) = 0
[pid   584] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   584] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   584] close(3)                    = 0
[pid   584] mkdir("./file0", 0777)      = 0
[pid   584] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   584] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   584] chdir("./file0")            = 0
[pid   584] ioctl(4, LOOP_CLR_FD)       = 0
[pid   584] close(4)                    = 0
[pid   584] creat("./bus", 000)         = 4
[pid   584] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   584] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   584] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   584] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   584] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   584] exit_group(0)               = ?
[pid   584] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=584, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./54", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./54", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./54/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./54/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./54/binderfs")                 = 0
[   31.994273][  T584] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   32.016698][  T584] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   32.029186][  T584] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./54/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./54/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./54/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./54/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./54/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./54/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./54")                           = 0
mkdir("./55", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 588
./strace-static-x86_64: Process 588 attached
[pid   588] set_robust_list(0x5555573e4660, 24) = 0
[pid   588] chdir("./55")               = 0
[pid   588] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   588] setpgid(0, 0)               = 0
[pid   588] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   588] write(3, "1000", 4)         = 4
[pid   588] close(3)                    = 0
[pid   588] symlink("/dev/binderfs", "./binderfs") = 0
[pid   588] memfd_create("syzkaller", 0) = 3
[pid   588] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   588] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   588] munmap(0x7f8811023000, 1048576) = 0
[pid   588] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   588] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   588] close(3)                    = 0
[pid   588] mkdir("./file0", 0777)      = 0
[pid   588] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   588] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   588] chdir("./file0")            = 0
[pid   588] ioctl(4, LOOP_CLR_FD)       = 0
[pid   588] close(4)                    = 0
[pid   588] creat("./bus", 000)         = 4
[pid   588] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   588] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   588] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   588] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   588] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   588] exit_group(0)               = ?
[pid   588] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=588, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./55", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./55", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./55/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./55/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./55/binderfs")                 = 0
[   32.124076][  T588] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   32.142151][  T588] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   32.154757][  T588] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./55/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./55/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./55/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./55/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./55/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./55/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./55")                           = 0
mkdir("./56", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 592
./strace-static-x86_64: Process 592 attached
[pid   592] set_robust_list(0x5555573e4660, 24) = 0
[pid   592] chdir("./56")               = 0
[pid   592] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   592] setpgid(0, 0)               = 0
[pid   592] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   592] write(3, "1000", 4)         = 4
[pid   592] close(3)                    = 0
[pid   592] symlink("/dev/binderfs", "./binderfs") = 0
[pid   592] memfd_create("syzkaller", 0) = 3
[pid   592] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   592] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   592] munmap(0x7f8811023000, 1048576) = 0
[pid   592] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   592] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   592] close(3)                    = 0
[pid   592] mkdir("./file0", 0777)      = 0
[pid   592] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   592] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   592] chdir("./file0")            = 0
[pid   592] ioctl(4, LOOP_CLR_FD)       = 0
[pid   592] close(4)                    = 0
[pid   592] creat("./bus", 000)         = 4
[pid   592] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   592] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   592] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   592] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   592] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   592] exit_group(0)               = ?
[pid   592] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=592, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
umount2("./56", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./56", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./56/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./56/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./56/binderfs")                 = 0
[   32.294098][  T592] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   32.316376][  T592] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   32.328754][  T592] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./56/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./56/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./56/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./56/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./56/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./56/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./56")                           = 0
mkdir("./57", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 596
./strace-static-x86_64: Process 596 attached
[pid   596] set_robust_list(0x5555573e4660, 24) = 0
[pid   596] chdir("./57")               = 0
[pid   596] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   596] setpgid(0, 0)               = 0
[pid   596] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   596] write(3, "1000", 4)         = 4
[pid   596] close(3)                    = 0
[pid   596] symlink("/dev/binderfs", "./binderfs") = 0
[pid   596] memfd_create("syzkaller", 0) = 3
[pid   596] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   596] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   596] munmap(0x7f8811023000, 1048576) = 0
[pid   596] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   596] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   596] close(3)                    = 0
[pid   596] mkdir("./file0", 0777)      = 0
[pid   596] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   596] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   596] chdir("./file0")            = 0
[pid   596] ioctl(4, LOOP_CLR_FD)       = 0
[pid   596] close(4)                    = 0
[pid   596] creat("./bus", 000)         = 4
[pid   596] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   596] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   596] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   596] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   596] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   596] exit_group(0)               = ?
[pid   596] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=596, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
umount2("./57", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./57", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./57/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./57/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./57/binderfs")                 = 0
[   32.504652][  T596] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   32.527076][  T596] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   32.539650][  T596] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./57/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./57/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./57/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./57/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./57/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./57/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./57")                           = 0
mkdir("./58", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 601
./strace-static-x86_64: Process 601 attached
[pid   601] set_robust_list(0x5555573e4660, 24) = 0
[pid   601] chdir("./58")               = 0
[pid   601] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   601] setpgid(0, 0)               = 0
[pid   601] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   601] write(3, "1000", 4)         = 4
[pid   601] close(3)                    = 0
[pid   601] symlink("/dev/binderfs", "./binderfs") = 0
[pid   601] memfd_create("syzkaller", 0) = 3
[pid   601] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   601] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   601] munmap(0x7f8811023000, 1048576) = 0
[pid   601] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   601] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   601] close(3)                    = 0
[pid   601] mkdir("./file0", 0777)      = 0
[pid   601] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   601] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   601] chdir("./file0")            = 0
[pid   601] ioctl(4, LOOP_CLR_FD)       = 0
[pid   601] close(4)                    = 0
[pid   601] creat("./bus", 000)         = 4
[pid   601] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   601] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   601] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   601] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   601] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   601] exit_group(0)               = ?
[pid   601] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=601, si_uid=0, si_status=0, si_utime=0, si_stime=2} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./58", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./58", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./58/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./58/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./58/binderfs")                 = 0
[   32.654336][  T601] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   32.671926][  T601] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   32.684383][  T601] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./58/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./58/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./58/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./58/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./58/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./58/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./58")                           = 0
mkdir("./59", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 605
./strace-static-x86_64: Process 605 attached
[pid   605] set_robust_list(0x5555573e4660, 24) = 0
[pid   605] chdir("./59")               = 0
[pid   605] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   605] setpgid(0, 0)               = 0
[pid   605] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   605] write(3, "1000", 4)         = 4
[pid   605] close(3)                    = 0
[pid   605] symlink("/dev/binderfs", "./binderfs") = 0
[pid   605] memfd_create("syzkaller", 0) = 3
[pid   605] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   605] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   605] munmap(0x7f8811023000, 1048576) = 0
[pid   605] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   605] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   605] close(3)                    = 0
[pid   605] mkdir("./file0", 0777)      = 0
[pid   605] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   605] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   605] chdir("./file0")            = 0
[pid   605] ioctl(4, LOOP_CLR_FD)       = 0
[pid   605] close(4)                    = 0
[pid   605] creat("./bus", 000)         = 4
[pid   605] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   605] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   605] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   605] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[   32.814298][  T605] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   32.839092][  T605] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[pid   605] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   605] exit_group(0)               = ?
[pid   605] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=605, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./59", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./59", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./59/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./59/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./59/binderfs")                 = 0
[   32.851582][  T605] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./59/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./59/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./59/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./59/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./59/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./59/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./59")                           = 0
mkdir("./60", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 609
./strace-static-x86_64: Process 609 attached
[pid   609] set_robust_list(0x5555573e4660, 24) = 0
[pid   609] chdir("./60")               = 0
[pid   609] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   609] setpgid(0, 0)               = 0
[pid   609] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   609] write(3, "1000", 4)         = 4
[pid   609] close(3)                    = 0
[pid   609] symlink("/dev/binderfs", "./binderfs") = 0
[pid   609] memfd_create("syzkaller", 0) = 3
[pid   609] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   609] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   609] munmap(0x7f8811023000, 1048576) = 0
[pid   609] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   609] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   609] close(3)                    = 0
[pid   609] mkdir("./file0", 0777)      = 0
[pid   609] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   609] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   609] chdir("./file0")            = 0
[pid   609] ioctl(4, LOOP_CLR_FD)       = 0
[pid   609] close(4)                    = 0
[pid   609] creat("./bus", 000)         = 4
[pid   609] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   609] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   609] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   609] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   609] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   609] exit_group(0)               = ?
[pid   609] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=609, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
umount2("./60", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./60", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./60/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./60/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./60/binderfs")                 = 0
[   32.944979][  T609] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   32.967947][  T609] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   32.980511][  T609] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./60/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./60/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./60/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./60/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./60/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./60/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./60")                           = 0
mkdir("./61", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 613
./strace-static-x86_64: Process 613 attached
[pid   613] set_robust_list(0x5555573e4660, 24) = 0
[pid   613] chdir("./61")               = 0
[pid   613] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   613] setpgid(0, 0)               = 0
[pid   613] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   613] write(3, "1000", 4)         = 4
[pid   613] close(3)                    = 0
[pid   613] symlink("/dev/binderfs", "./binderfs") = 0
[pid   613] memfd_create("syzkaller", 0) = 3
[pid   613] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   613] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   613] munmap(0x7f8811023000, 1048576) = 0
[pid   613] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   613] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   613] close(3)                    = 0
[pid   613] mkdir("./file0", 0777)      = 0
[pid   613] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   613] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   613] chdir("./file0")            = 0
[pid   613] ioctl(4, LOOP_CLR_FD)       = 0
[pid   613] close(4)                    = 0
[pid   613] creat("./bus", 000)         = 4
[pid   613] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   613] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   613] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   613] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   613] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   613] exit_group(0)               = ?
[pid   613] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=613, si_uid=0, si_status=0, si_utime=0, si_stime=3} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./61", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./61", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./61/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./61/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./61/binderfs")                 = 0
[   33.074327][  T613] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   33.096182][  T613] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   33.109262][  T613] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0
umount2("./61/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./61/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./61/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./61/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./61/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x5555573ed730 /* 2 entries */, 32768) = 48
getdents64(4, 0x5555573ed730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./61/file0")                     = 0
getdents64(3, 0x5555573e56f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./61")                           = 0
mkdir("./62", 0777)                     = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555573e4650) = 617
./strace-static-x86_64: Process 617 attached
[pid   617] set_robust_list(0x5555573e4660, 24) = 0
[pid   617] chdir("./62")               = 0
[pid   617] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid   617] setpgid(0, 0)               = 0
[pid   617] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid   617] write(3, "1000", 4)         = 4
[pid   617] close(3)                    = 0
[pid   617] symlink("/dev/binderfs", "./binderfs") = 0
[pid   617] memfd_create("syzkaller", 0) = 3
[pid   617] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8811023000
[pid   617] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid   617] munmap(0x7f8811023000, 1048576) = 0
[pid   617] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid   617] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid   617] close(3)                    = 0
[pid   617] mkdir("./file0", 0777)      = 0
[pid   617] mount("/dev/loop0", "./file0", "ext4", MS_DIRSYNC|MS_NOATIME|MS_LAZYTIME, ",errors=continue") = 0
[pid   617] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid   617] chdir("./file0")            = 0
[pid   617] ioctl(4, LOOP_CLR_FD)       = 0
[pid   617] close(4)                    = 0
[pid   617] creat("./bus", 000)         = 4
[pid   617] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid   617] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid   617] mmap(0x20000000, 6291456, PROT_READ|PROT_WRITE|PROT_EXEC|PROT_SEM|PROT_GROWSUP|0x7ffff0, MAP_SHARED|MAP_FIXED|MAP_LOCKED|1<<MAP_HUGE_SHIFT, 5, 0) = 0x20000000
[pid   617] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_TRACING, insn_cnt=0, insns=NULL, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=-1, fd_array=0x20000800}, 128) = -1 E2BIG (Argument list too long)
[pid   617] write(4, "\xef", 1)         = -1 EUCLEAN (Structure needs cleaning)
[pid   617] exit_group(0)               = ?
[pid   617] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=617, si_uid=0, si_status=0, si_utime=0, si_stime=4} ---
umount2("./62", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./62", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x5555573e56f0 /* 4 entries */, 32768) = 112
umount2("./62/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./62/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./62/binderfs")                 = 0
[   33.264176][  T617] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
[   33.285787][  T617] EXT4-fs error (device loop0): ext4_xattr_ibody_get:617: inode #18: comm syz-executor197: corrupted in-inode xattr
[   33.298299][  T617] EXT4-fs error (device loop0): ext4_read_block_bitmap_nowait:430: comm syz-executor197: Invalid block bitmap block 4294967295 in block_group 0