./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1279702735 <...> Warning: Permanently added '10.128.1.136' (ED25519) to the list of known hosts. execve("./syz-executor1279702735", ["./syz-executor1279702735"], 0x7ffde5e09f70 /* 10 vars */) = 0 brk(NULL) = 0x555586e68000 brk(0x555586e68d40) = 0x555586e68d40 arch_prctl(ARCH_SET_FS, 0x555586e683c0) = 0 set_tid_address(0x555586e68690) = 5826 set_robust_list(0x555586e686a0, 24) = 0 rseq(0x555586e68ce0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1279702735", 4096) = 28 getrandom("\x11\x09\x31\x6e\xe3\xfa\x2c\x71", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555586e68d40 brk(0x555586e89d40) = 0x555586e89d40 brk(0x555586e8a000) = 0x555586e8a000 mprotect(0x7fe178eed000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 mkdir("./syzkaller.6I9iu7", 0700) = 0 chmod("./syzkaller.6I9iu7", 0777) = 0 chdir("./syzkaller.6I9iu7") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5828 attached [pid 5828] set_robust_list(0x555586e686a0, 24 [pid 5826] <... clone resumed>, child_tidptr=0x555586e68690) = 5828 [pid 5828] <... set_robust_list resumed>) = 0 [pid 5828] chdir("./0") = 0 [pid 5828] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5828] setpgid(0, 0) = 0 [pid 5828] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "1000", 4) = 4 [pid 5828] close(3) = 0 [pid 5828] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5828] write(1, "executing program\n", 18) = 18 [pid 5828] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5828] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5828] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5828] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5828] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5828] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5828] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0} => {parent_tid=[5830]}, 88) = 5830 ./strace-static-x86_64: Process 5830 attached [pid 5830] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5828] rt_sigprocmask(SIG_SETMASK, [], [pid 5830] set_robust_list(0x7fe178e1b9a0, 24 [pid 5828] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5830] <... set_robust_list resumed>) = 0 [pid 5828] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] rt_sigprocmask(SIG_SETMASK, [], [pid 5828] <... futex resumed>) = 0 [pid 5830] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5828] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5830] memfd_create("syzkaller", 0) = 3 [pid 5830] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5830] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5830] munmap(0x7fe170800000, 138412032) = 0 [pid 5830] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5830] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5830] close(3) = 0 [pid 5830] close(4) = 0 [pid 5830] mkdir("./file0", 0777) = 0 [ 87.101185][ T5830] loop0: detected capacity change from 0 to 32768 [ 87.140553][ T5830] (syz-executor127,5830,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 87.156430][ T5830] (syz-executor127,5830,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 87.180274][ T5830] JBD2: Ignoring recovery information on journal [pid 5830] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5830] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5830] chdir("./file0") = 0 [pid 5830] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5830] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [ 87.210990][ T5830] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 87.225983][ T12] ocfs2: Finishing quota recovery on device (7,0) for slot 0 [pid 5830] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5828] <... futex resumed>) = 0 [pid 5828] exit_group(0) = ? [pid 5830] <... futex resumed>) = ? [pid 5830] +++ exited with 0 +++ [pid 5828] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5828, si_uid=0, si_status=0, si_utime=7 /* 0.07 s */, si_stime=26 /* 0.26 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./0/binderfs") = 0 [ 87.386429][ T5826] [ 87.388787][ T5826] ====================================================== [ 87.395791][ T5826] WARNING: possible circular locking dependency detected [ 87.402795][ T5826] 6.15.0-rc2-syzkaller-00037-g834a4a689699 #0 Not tainted [ 87.409881][ T5826] ------------------------------------------------------ [ 87.416897][ T5826] syz-executor127/5826 is trying to acquire lock: [ 87.423293][ T5826] ffff888028de0948 ((wq_completion)ocfs2_wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0xb1/0x170 [ 87.433564][ T5826] [ 87.433564][ T5826] but task is already holding lock: [ 87.440912][ T5826] ffff88805408e0e0 (&type->s_umount_key#43){++++}-{4:4}, at: deactivate_super+0xb5/0xf0 [ 87.450660][ T5826] [ 87.450660][ T5826] which lock already depends on the new lock. [ 87.450660][ T5826] [ 87.461052][ T5826] [ 87.461052][ T5826] the existing dependency chain (in reverse order) is: [ 87.470051][ T5826] [ 87.470051][ T5826] -> #2 (&type->s_umount_key#43){++++}-{4:4}: [ 87.478314][ T5826] lock_acquire+0x116/0x2f0 [ 87.483339][ T5826] down_read+0xb3/0xa50 [ 87.488043][ T5826] ocfs2_finish_quota_recovery+0x15e/0x2310 [ 87.494460][ T5826] ocfs2_complete_recovery+0x1977/0x2580 [ 87.500621][ T5826] process_scheduled_works+0xac3/0x18e0 [ 87.506702][ T5826] worker_thread+0x870/0xd50 [ 87.511816][ T5826] kthread+0x7b7/0x940 [ 87.516409][ T5826] ret_from_fork+0x4b/0x80 [ 87.521342][ T5826] ret_from_fork_asm+0x1a/0x30 [ 87.526627][ T5826] [ 87.526627][ T5826] -> #1 ((work_completion)(&journal->j_recovery_work)){+.+.}-{0:0}: [ 87.536882][ T5826] lock_acquire+0x116/0x2f0 [ 87.541898][ T5826] process_scheduled_works+0x9e9/0x18e0 [ 87.547960][ T5826] worker_thread+0x870/0xd50 [ 87.553080][ T5826] kthread+0x7b7/0x940 [ 87.557670][ T5826] ret_from_fork+0x4b/0x80 [ 87.562594][ T5826] ret_from_fork_asm+0x1a/0x30 [ 87.567892][ T5826] [ 87.567892][ T5826] -> #0 ((wq_completion)ocfs2_wq){+.+.}-{0:0}: [ 87.576233][ T5826] validate_chain+0xa69/0x24e0 [ 87.581521][ T5826] __lock_acquire+0xad5/0xd80 [ 87.586722][ T5826] lock_acquire+0x116/0x2f0 [ 87.591739][ T5826] touch_wq_lockdep_map+0xc7/0x170 [ 87.597366][ T5826] __flush_workqueue+0x14c/0x1280 [ 87.602908][ T5826] ocfs2_shutdown_local_alloc+0x10b/0xab0 [ 87.609147][ T5826] ocfs2_dismount_volume+0x204/0x910 [ 87.614962][ T5826] generic_shutdown_super+0x139/0x2d0 [ 87.620850][ T5826] kill_block_super+0x44/0x90 [ 87.626044][ T5826] deactivate_locked_super+0xc4/0x130 [ 87.631931][ T5826] cleanup_mnt+0x422/0x4c0 [ 87.636863][ T5826] task_work_run+0x251/0x310 [ 87.641972][ T5826] ptrace_notify+0x2dc/0x390 [ 87.647174][ T5826] syscall_exit_work+0xc7/0x1d0 [ 87.652540][ T5826] syscall_exit_to_user_mode+0x24a/0x340 [ 87.658779][ T5826] do_syscall_64+0x100/0x230 [ 87.663889][ T5826] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.670292][ T5826] [ 87.670292][ T5826] other info that might help us debug this: [ 87.670292][ T5826] [ 87.680509][ T5826] Chain exists of: [ 87.680509][ T5826] (wq_completion)ocfs2_wq --> (work_completion)(&journal->j_recovery_work) --> &type->s_umount_key#43 [ 87.680509][ T5826] [ 87.697374][ T5826] Possible unsafe locking scenario: [ 87.697374][ T5826] [ 87.704814][ T5826] CPU0 CPU1 [ 87.710167][ T5826] ---- ---- [ 87.715521][ T5826] lock(&type->s_umount_key#43); [ 87.720545][ T5826] lock((work_completion)(&journal->j_recovery_work)); [ 87.729992][ T5826] lock(&type->s_umount_key#43); [ 87.737532][ T5826] lock((wq_completion)ocfs2_wq); [ 87.742639][ T5826] [ 87.742639][ T5826] *** DEADLOCK *** [ 87.742639][ T5826] [ 87.750773][ T5826] 1 lock held by syz-executor127/5826: [ 87.756221][ T5826] #0: ffff88805408e0e0 (&type->s_umount_key#43){++++}-{4:4}, at: deactivate_super+0xb5/0xf0 [ 87.766419][ T5826] [ 87.766419][ T5826] stack backtrace: [ 87.772422][ T5826] CPU: 1 UID: 0 PID: 5826 Comm: syz-executor127 Not tainted 6.15.0-rc2-syzkaller-00037-g834a4a689699 #0 PREEMPT(full) [ 87.772470][ T5826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 87.772484][ T5826] Call Trace: [ 87.772493][ T5826] [ 87.772505][ T5826] dump_stack_lvl+0x241/0x360 [ 87.772539][ T5826] ? __pfx_dump_stack_lvl+0x10/0x10 [ 87.772565][ T5826] ? __pfx__printk+0x10/0x10 [ 87.772585][ T5826] ? print_lock+0x171/0x1a0 [ 87.772603][ T5826] print_circular_bug+0x2e1/0x300 [ 87.772625][ T5826] check_noncircular+0x142/0x160 [ 87.772657][ T5826] validate_chain+0xa69/0x24e0 [ 87.772676][ T5826] ? _raw_spin_unlock_irqrestore+0xde/0x140 [ 87.772695][ T5826] ? dquot_disable+0x1158/0x1cf0 [ 87.772720][ T5826] ? ocfs2_disable_quotas+0x1bc/0x210 [ 87.772736][ T5826] ? kill_block_super+0x44/0x90 [ 87.772762][ T5826] ? debug_object_assert_init+0x30e/0x4d0 [ 87.772780][ T5826] __lock_acquire+0xad5/0xd80 [ 87.772798][ T5826] lock_acquire+0x116/0x2f0 [ 87.772811][ T5826] ? touch_wq_lockdep_map+0xb1/0x170 [ 87.772834][ T5826] ? touch_wq_lockdep_map+0xb1/0x170 [ 87.772852][ T5826] touch_wq_lockdep_map+0xc7/0x170 [ 87.772871][ T5826] ? touch_wq_lockdep_map+0xb1/0x170 [ 87.772890][ T5826] __flush_workqueue+0x14c/0x1280 [ 87.772909][ T5826] ? kfree+0x198/0x430 [ 87.772922][ T5826] ? ocfs2_local_free_info+0x8ba/0xa60 [ 87.772947][ T5826] ? __pfx___flush_workqueue+0x10/0x10 [ 87.772971][ T5826] ? work_grab_pending+0x4d6/0xb00 [ 87.772991][ T5826] ocfs2_shutdown_local_alloc+0x10b/0xab0 [ 87.773007][ T5826] ? __pfx_work_grab_pending+0x10/0x10 [ 87.773027][ T5826] ? __pfx_ocfs2_shutdown_local_alloc+0x10/0x10 [ 87.773043][ T5826] ? lockdep_hardirqs_on+0x9d/0x150 [ 87.773062][ T5826] ? enable_work+0x2e4/0x360 [ 87.773082][ T5826] ? __pfx_enable_work+0x10/0x10 [ 87.773102][ T5826] ? _atomic_dec_and_lock+0x9a/0x130 [ 87.773121][ T5826] ? iput+0x3be/0xa50 [ 87.773141][ T5826] ocfs2_dismount_volume+0x204/0x910 [ 87.773169][ T5826] ? __pfx_ocfs2_dismount_volume+0x10/0x10 [ 87.773195][ T5826] ? __pfx_evict_inodes+0x10/0x10 [ 87.773214][ T5826] ? __pfx_ocfs2_put_super+0x10/0x10 [ 87.773229][ T5826] generic_shutdown_super+0x139/0x2d0 [ 87.773251][ T5826] kill_block_super+0x44/0x90 [ 87.773275][ T5826] deactivate_locked_super+0xc4/0x130 [ 87.773296][ T5826] cleanup_mnt+0x422/0x4c0 [ 87.773317][ T5826] ? lockdep_hardirqs_on+0x9d/0x150 [ 87.773336][ T5826] task_work_run+0x251/0x310 [ 87.773361][ T5826] ? __pfx_task_work_run+0x10/0x10 [ 87.773386][ T5826] ? path_umount+0x251/0xfb0 [ 87.773401][ T5826] ptrace_notify+0x2dc/0x390 [ 87.773425][ T5826] ? __x64_sys_umount+0x122/0x170 [ 87.773439][ T5826] ? user_path_at+0x44/0x60 [ 87.773461][ T5826] ? __pfx_ptrace_notify+0x10/0x10 [ 87.773483][ T5826] ? kmem_cache_free+0x197/0x410 [ 87.773502][ T5826] ? __x64_sys_umount+0x122/0x170 [ 87.773518][ T5826] syscall_exit_work+0xc7/0x1d0 [ 87.773536][ T5826] syscall_exit_to_user_mode+0x24a/0x340 [ 87.773557][ T5826] do_syscall_64+0x100/0x230 [ 87.773577][ T5826] ? clear_bhb_loop+0x45/0xa0 [ 87.773595][ T5826] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.773619][ T5826] RIP: 0033:0x7fe178e67d77 [ 87.773639][ T5826] Code: 08 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 [ 87.773652][ T5826] RSP: 002b:00007ffd02a51f08 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 [ 87.773668][ T5826] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe178e67d77 [ 87.773678][ T5826] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd02a51fc0 [ 87.773687][ T5826] RBP: 00007ffd02a51fc0 R08: 0000000000000000 R09: 0000000000000000 [ 87.773697][ T5826] R10: 00000000ffffffff R11: 0000000000000202 R12: 00007ffd02a53070 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./0/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 87.773712][ T5826] R13: 0000555586e69700 R14: 431bde82d7b634db R15: 00007ffd02a53014 [ 87.773730][ T5826] [ 88.154979][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5833 attached , child_tidptr=0x555586e68690) = 5833 [pid 5833] set_robust_list(0x555586e686a0, 24) = 0 [pid 5833] chdir("./1") = 0 [pid 5833] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5833] setpgid(0, 0) = 0 [pid 5833] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5833] write(3, "1000", 4) = 4 [pid 5833] close(3) = 0 [pid 5833] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5833] write(1, "executing program\n", 18executing program ) = 18 [pid 5833] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5833] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5833] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5833] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5833] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5833] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5833] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5834 attached [pid 5834] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5834] set_robust_list(0x7fe178e1b9a0, 24) = 0 [pid 5834] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5834] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5833] <... clone3 resumed> => {parent_tid=[5834]}, 88) = 5834 [pid 5833] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5833] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5834] <... futex resumed>) = 0 [pid 5833] <... futex resumed>) = 1 [pid 5834] memfd_create("syzkaller", 0 [pid 5833] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5834] <... memfd_create resumed>) = 3 [pid 5834] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5834] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5834] munmap(0x7fe170800000, 138412032) = 0 [pid 5834] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5834] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5834] close(3) = 0 [pid 5834] close(4) = 0 [pid 5834] mkdir("./file0", 0777) = 0 [ 88.367740][ T5834] loop0: detected capacity change from 0 to 32768 [ 88.399571][ T5834] (syz-executor127,5834,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [pid 5834] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5834] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [ 88.414005][ T5834] (syz-executor127,5834,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 88.432614][ T5834] JBD2: Ignoring recovery information on journal [ 88.453122][ T5834] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [pid 5834] chdir("./file0") = 0 [pid 5834] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5834] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5833] <... futex resumed>) = 0 [pid 5834] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5833] exit_group(0 [pid 5834] <... futex resumed>) = ? [pid 5833] <... exit_group resumed>) = ? [pid 5834] +++ exited with 0 +++ [pid 5833] +++ exited with 0 +++ [ 88.465012][ T999] ocfs2: Finishing quota recovery on device (7,0) for slot 0 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5833, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=15 /* 0.15 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./1/binderfs") = 0 umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./1/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./1/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 88.566810][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555586e68690) = 5837 ./strace-static-x86_64: Process 5837 attached [pid 5837] set_robust_list(0x555586e686a0, 24) = 0 [pid 5837] chdir("./2") = 0 [pid 5837] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5837] setpgid(0, 0) = 0 [pid 5837] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5837] write(3, "1000", 4) = 4 [pid 5837] close(3) = 0 [pid 5837] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5837] write(1, "executing program\n", 18) = 18 [pid 5837] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5837] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5837] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5837] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5837] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5837] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5837] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5838 attached => {parent_tid=[5838]}, 88) = 5838 [pid 5838] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5838] set_robust_list(0x7fe178e1b9a0, 24 [pid 5837] rt_sigprocmask(SIG_SETMASK, [], [pid 5838] <... set_robust_list resumed>) = 0 [pid 5837] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5838] rt_sigprocmask(SIG_SETMASK, [], [pid 5837] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5838] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5837] <... futex resumed>) = 0 [pid 5838] memfd_create("syzkaller", 0 [pid 5837] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5838] <... memfd_create resumed>) = 3 [pid 5838] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5838] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5838] munmap(0x7fe170800000, 138412032) = 0 [pid 5838] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5838] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5838] close(3) = 0 [pid 5838] close(4) = 0 [pid 5838] mkdir("./file0", 0777) = 0 [ 88.930203][ T5838] loop0: detected capacity change from 0 to 32768 [ 88.972173][ T5838] (syz-executor127,5838,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 88.986469][ T5838] (syz-executor127,5838,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 89.005084][ T5838] JBD2: Ignoring recovery information on journal [pid 5838] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5838] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5838] chdir("./file0") = 0 [pid 5838] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5838] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5837] <... futex resumed>) = 0 [pid 5838] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5837] exit_group(0) = ? [pid 5838] <... futex resumed>) = ? [pid 5838] +++ exited with 0 +++ [pid 5837] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5837, si_uid=0, si_status=0, si_utime=4 /* 0.04 s */, si_stime=13 /* 0.13 s */} --- umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./2/binderfs") = 0 [ 89.024998][ T5838] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 89.036190][ T12] ocfs2: Finishing quota recovery on device (7,0) for slot 0 umount2("./2/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./2/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./2/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./2/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./2/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./2") = 0 mkdir("./3", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 89.068513][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5841 attached [pid 5841] set_robust_list(0x555586e686a0, 24 [pid 5826] <... clone resumed>, child_tidptr=0x555586e68690) = 5841 [pid 5841] <... set_robust_list resumed>) = 0 [pid 5841] chdir("./3") = 0 [pid 5841] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5841] setpgid(0, 0) = 0 [pid 5841] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5841] write(3, "1000", 4) = 4 [pid 5841] close(3) = 0 [pid 5841] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5841] write(1, "executing program\n", 18) = 18 [pid 5841] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5841] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5841] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5841] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5841] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5841] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5841] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5842 attached => {parent_tid=[5842]}, 88) = 5842 [pid 5841] rt_sigprocmask(SIG_SETMASK, [], [pid 5842] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053 [pid 5841] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5842] <... rseq resumed>) = 0 [pid 5842] set_robust_list(0x7fe178e1b9a0, 24) = 0 [pid 5841] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5842] rt_sigprocmask(SIG_SETMASK, [], [pid 5841] <... futex resumed>) = 0 [pid 5842] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5841] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5842] memfd_create("syzkaller", 0) = 3 [pid 5842] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5842] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5842] munmap(0x7fe170800000, 138412032) = 0 [pid 5842] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5842] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5842] close(3) = 0 [pid 5842] close(4) = 0 [pid 5842] mkdir("./file0", 0777) = 0 [ 89.430404][ T5842] loop0: detected capacity change from 0 to 32768 [ 89.475014][ T5842] (syz-executor127,5842,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 89.491810][ T5842] (syz-executor127,5842,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 89.510359][ T5842] JBD2: Ignoring recovery information on journal [pid 5842] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5842] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5842] chdir("./file0") = 0 [pid 5842] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5842] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5841] <... futex resumed>) = 0 [pid 5842] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5841] exit_group(0 [pid 5842] <... futex resumed>) = ? [ 89.529092][ T5842] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 89.540693][ T999] ocfs2: Finishing quota recovery on device (7,0) for slot 0 [pid 5841] <... exit_group resumed>) = ? [pid 5842] +++ exited with 0 +++ [pid 5841] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5841, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=15 /* 0.15 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./3/binderfs") = 0 umount2("./3/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./3/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./3/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./3/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [ 89.683350][ T5826] ocfs2: Unmounting device (7,0) on (node local) newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./3/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./3") = 0 mkdir("./4", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5845 attached [pid 5845] set_robust_list(0x555586e686a0, 24) = 0 [pid 5845] chdir("./4" [pid 5826] <... clone resumed>, child_tidptr=0x555586e68690) = 5845 [pid 5845] <... chdir resumed>) = 0 [pid 5845] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5845] setpgid(0, 0) = 0 [pid 5845] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5845] write(3, "1000", 4) = 4 [pid 5845] close(3) = 0 [pid 5845] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5845] write(1, "executing program\n", 18) = 18 [pid 5845] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5845] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5845] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5845] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5845] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5845] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5845] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5846 attached [pid 5846] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5845] <... clone3 resumed> => {parent_tid=[5846]}, 88) = 5846 [pid 5846] set_robust_list(0x7fe178e1b9a0, 24 [pid 5845] rt_sigprocmask(SIG_SETMASK, [], [pid 5846] <... set_robust_list resumed>) = 0 [pid 5845] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5846] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5845] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5846] memfd_create("syzkaller", 0 [pid 5845] <... futex resumed>) = 0 [pid 5845] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5846] <... memfd_create resumed>) = 3 [pid 5846] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5846] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5846] munmap(0x7fe170800000, 138412032) = 0 [pid 5846] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5846] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5846] close(3) = 0 [pid 5846] close(4) = 0 [pid 5846] mkdir("./file0", 0777) = 0 [ 90.138331][ T5846] loop0: detected capacity change from 0 to 32768 [ 90.160155][ T5846] (syz-executor127,5846,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 90.174418][ T5846] (syz-executor127,5846,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [pid 5846] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5846] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5846] chdir("./file0") = 0 [pid 5846] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [ 90.192315][ T5846] JBD2: Ignoring recovery information on journal [ 90.212495][ T5846] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 90.225325][ T12] ocfs2: Finishing quota recovery on device (7,0) for slot 0 [pid 5846] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5845] <... futex resumed>) = 0 [pid 5846] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5845] exit_group(0) = ? [pid 5846] <... futex resumed>) = ? [pid 5846] +++ exited with 0 +++ [pid 5845] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5845, si_uid=0, si_status=0, si_utime=4 /* 0.04 s */, si_stime=10 /* 0.10 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./4/binderfs") = 0 umount2("./4/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./4/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./4/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./4/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./4/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./4") = 0 mkdir("./5", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 90.427803][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5849 attached [pid 5849] set_robust_list(0x555586e686a0, 24 [pid 5826] <... clone resumed>, child_tidptr=0x555586e68690) = 5849 [pid 5849] <... set_robust_list resumed>) = 0 [pid 5849] chdir("./5") = 0 [pid 5849] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5849] setpgid(0, 0) = 0 [pid 5849] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5849] write(3, "1000", 4) = 4 [pid 5849] close(3) = 0 [pid 5849] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5849] write(1, "executing program\n", 18) = 18 [pid 5849] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5849] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5849] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5849] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5849] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5849] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5849] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5850 attached [pid 5850] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5849] <... clone3 resumed> => {parent_tid=[5850]}, 88) = 5850 [pid 5850] set_robust_list(0x7fe178e1b9a0, 24 [pid 5849] rt_sigprocmask(SIG_SETMASK, [], [pid 5850] <... set_robust_list resumed>) = 0 [pid 5849] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5850] rt_sigprocmask(SIG_SETMASK, [], [pid 5849] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5850] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5849] <... futex resumed>) = 0 [pid 5850] memfd_create("syzkaller", 0 [pid 5849] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5850] <... memfd_create resumed>) = 3 [pid 5850] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5850] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5850] munmap(0x7fe170800000, 138412032) = 0 [pid 5850] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5850] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5850] close(3) = 0 [pid 5850] close(4) = 0 [pid 5850] mkdir("./file0", 0777) = 0 [ 90.785736][ T5850] loop0: detected capacity change from 0 to 32768 [ 90.829538][ T5850] (syz-executor127,5850,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 90.844290][ T5850] (syz-executor127,5850,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 90.862521][ T5850] JBD2: Ignoring recovery information on journal [pid 5850] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5850] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5850] chdir("./file0") = 0 [pid 5850] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5850] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5849] <... futex resumed>) = 0 [pid 5849] exit_group(0) = ? [pid 5850] +++ exited with 0 +++ [pid 5849] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5849, si_uid=0, si_status=0, si_utime=4 /* 0.04 s */, si_stime=11 /* 0.11 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 90.881744][ T5850] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 90.893018][ T12] ocfs2: Finishing quota recovery on device (7,0) for slot 0 openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./5/binderfs") = 0 umount2("./5/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./5/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./5/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./5/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./5/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./5") = 0 mkdir("./6", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 91.012306][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5853 attached , child_tidptr=0x555586e68690) = 5853 [pid 5853] set_robust_list(0x555586e686a0, 24) = 0 [pid 5853] chdir("./6") = 0 [pid 5853] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5853] setpgid(0, 0) = 0 [pid 5853] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5853] write(3, "1000", 4) = 4 [pid 5853] close(3) = 0 [pid 5853] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5853] write(1, "executing program\n", 18executing program ) = 18 [pid 5853] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5853] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5853] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5853] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5853] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5853] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5853] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5854 attached [pid 5854] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5854] set_robust_list(0x7fe178e1b9a0, 24 [pid 5853] <... clone3 resumed> => {parent_tid=[5854]}, 88) = 5854 [pid 5854] <... set_robust_list resumed>) = 0 [pid 5854] rt_sigprocmask(SIG_SETMASK, [], [pid 5853] rt_sigprocmask(SIG_SETMASK, [], [pid 5854] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5853] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5853] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5853] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5854] memfd_create("syzkaller", 0) = 3 [pid 5854] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5854] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5854] munmap(0x7fe170800000, 138412032) = 0 [pid 5854] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5854] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5854] close(3) = 0 [pid 5854] close(4) = 0 [pid 5854] mkdir("./file0", 0777) = 0 [ 91.365151][ T5854] loop0: detected capacity change from 0 to 32768 [ 91.386341][ T5854] (syz-executor127,5854,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [pid 5854] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5854] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5854] chdir("./file0") = 0 [pid 5854] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5854] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5854] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5853] <... futex resumed>) = 0 [pid 5853] exit_group(0 [pid 5854] <... futex resumed>) = ? [pid 5853] <... exit_group resumed>) = ? [pid 5854] +++ exited with 0 +++ [pid 5853] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5853, si_uid=0, si_status=0, si_utime=4 /* 0.04 s */, si_stime=12 /* 0.12 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./6/binderfs") = 0 [ 91.403679][ T5854] (syz-executor127,5854,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 91.423373][ T5854] JBD2: Ignoring recovery information on journal [ 91.445166][ T5854] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 91.457097][ T12] ocfs2: Finishing quota recovery on device (7,0) for slot 0 umount2("./6/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./6/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./6/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./6/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./6/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./6") = 0 mkdir("./7", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 91.495974][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5857 attached , child_tidptr=0x555586e68690) = 5857 [pid 5857] set_robust_list(0x555586e686a0, 24) = 0 [pid 5857] chdir("./7") = 0 [pid 5857] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5857] setpgid(0, 0) = 0 [pid 5857] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5857] write(3, "1000", 4) = 4 [pid 5857] close(3) = 0 [pid 5857] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5857] write(1, "executing program\n", 18) = 18 [pid 5857] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5857] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5857] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5857] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5857] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5857] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5857] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5858 attached [pid 5858] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5858] set_robust_list(0x7fe178e1b9a0, 24 [pid 5857] <... clone3 resumed> => {parent_tid=[5858]}, 88) = 5858 [pid 5858] <... set_robust_list resumed>) = 0 [pid 5857] rt_sigprocmask(SIG_SETMASK, [], [pid 5858] rt_sigprocmask(SIG_SETMASK, [], [pid 5857] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5858] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5857] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5858] memfd_create("syzkaller", 0 [pid 5857] <... futex resumed>) = 0 [pid 5857] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5858] <... memfd_create resumed>) = 3 [pid 5858] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5858] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5858] munmap(0x7fe170800000, 138412032) = 0 [pid 5858] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5858] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5858] close(3) = 0 [pid 5858] close(4) = 0 [pid 5858] mkdir("./file0", 0777) = 0 [ 91.835765][ T3406] cfg80211: failed to load regulatory.db [ 91.847164][ T5858] loop0: detected capacity change from 0 to 32768 [ 91.879096][ T5858] (syz-executor127,5858,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 91.894112][ T5858] (syz-executor127,5858,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 91.912720][ T5858] JBD2: Ignoring recovery information on journal [pid 5858] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5858] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5858] chdir("./file0") = 0 [pid 5858] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5858] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5857] <... futex resumed>) = 0 [pid 5858] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5857] exit_group(0) = ? [pid 5858] <... futex resumed>) = ? [pid 5858] +++ exited with 0 +++ [pid 5857] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5857, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=14 /* 0.14 s */} --- [ 91.931942][ T5858] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 91.943179][ T12] ocfs2: Finishing quota recovery on device (7,0) for slot 0 umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./7/binderfs") = 0 umount2("./7/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./7/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./7/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./7/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./7/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./7") = 0 mkdir("./8", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 92.115529][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5861 attached [pid 5861] set_robust_list(0x555586e686a0, 24 [pid 5826] <... clone resumed>, child_tidptr=0x555586e68690) = 5861 [pid 5861] <... set_robust_list resumed>) = 0 [pid 5861] chdir("./8") = 0 [pid 5861] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5861] setpgid(0, 0) = 0 [pid 5861] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5861] write(3, "1000", 4) = 4 [pid 5861] close(3) = 0 [pid 5861] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5861] write(1, "executing program\n", 18executing program ) = 18 [pid 5861] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5861] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5861] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5861] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5861] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5861] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5861] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5862 attached [pid 5862] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5861] <... clone3 resumed> => {parent_tid=[5862]}, 88) = 5862 [pid 5862] set_robust_list(0x7fe178e1b9a0, 24) = 0 [pid 5861] rt_sigprocmask(SIG_SETMASK, [], [pid 5862] rt_sigprocmask(SIG_SETMASK, [], [pid 5861] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5862] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5861] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5861] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5862] memfd_create("syzkaller", 0) = 3 [pid 5862] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5862] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5862] munmap(0x7fe170800000, 138412032) = 0 [pid 5862] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5862] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5862] close(3) = 0 [pid 5862] close(4) = 0 [pid 5862] mkdir("./file0", 0777) = 0 [ 92.435664][ T5862] loop0: detected capacity change from 0 to 32768 [ 92.457536][ T5862] (syz-executor127,5862,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 92.471960][ T5862] (syz-executor127,5862,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [pid 5862] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5862] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5862] chdir("./file0") = 0 [pid 5862] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5862] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5861] <... futex resumed>) = 0 [pid 5862] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5861] exit_group(0 [pid 5862] <... futex resumed>) = ? [pid 5861] <... exit_group resumed>) = ? [pid 5862] +++ exited with 0 +++ [pid 5861] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5861, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=13 /* 0.13 s */} --- umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 92.489814][ T5862] JBD2: Ignoring recovery information on journal [ 92.508876][ T5862] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 92.520129][ T999] ocfs2: Finishing quota recovery on device (7,0) for slot 0 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./8/binderfs") = 0 umount2("./8/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./8/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./8/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./8/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 92.650167][ T5826] ocfs2: Unmounting device (7,0) on (node local) openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./8/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./8") = 0 mkdir("./9", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5865 attached , child_tidptr=0x555586e68690) = 5865 [pid 5865] set_robust_list(0x555586e686a0, 24) = 0 [pid 5865] chdir("./9") = 0 [pid 5865] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5865] setpgid(0, 0) = 0 [pid 5865] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5865] write(3, "1000", 4) = 4 [pid 5865] close(3) = 0 [pid 5865] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5865] write(1, "executing program\n", 18) = 18 [pid 5865] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5865] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5865] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5865] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5865] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5865] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5865] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5866 attached => {parent_tid=[5866]}, 88) = 5866 [pid 5866] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5865] rt_sigprocmask(SIG_SETMASK, [], [pid 5866] set_robust_list(0x7fe178e1b9a0, 24 [pid 5865] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5866] <... set_robust_list resumed>) = 0 [pid 5866] rt_sigprocmask(SIG_SETMASK, [], [pid 5865] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5866] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5865] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5866] memfd_create("syzkaller", 0) = 3 [pid 5866] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5866] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5866] munmap(0x7fe170800000, 138412032) = 0 [pid 5866] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5866] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5866] close(3) = 0 [pid 5866] close(4) = 0 [pid 5866] mkdir("./file0", 0777) = 0 [ 93.140818][ T5866] loop0: detected capacity change from 0 to 32768 [ 93.172014][ T5866] (syz-executor127,5866,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 93.186575][ T5866] (syz-executor127,5866,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 93.205501][ T5866] JBD2: Ignoring recovery information on journal [ 93.225624][ T5866] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [pid 5866] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5866] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5866] chdir("./file0") = 0 [pid 5866] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5866] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5865] <... futex resumed>) = 0 [pid 5866] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5865] exit_group(0 [pid 5866] <... futex resumed>) = ? [pid 5865] <... exit_group resumed>) = ? [pid 5866] +++ exited with 0 +++ [ 93.236947][ T69] ocfs2: Finishing quota recovery on device (7,0) for slot 0 [pid 5865] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5865, si_uid=0, si_status=0, si_utime=0, si_stime=16 /* 0.16 s */} --- umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./9/binderfs") = 0 umount2("./9/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./9/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./9/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./9/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./9/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./9") = 0 mkdir("./10", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 93.390358][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5869 attached , child_tidptr=0x555586e68690) = 5869 [pid 5869] set_robust_list(0x555586e686a0, 24) = 0 [pid 5869] chdir("./10") = 0 [pid 5869] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5869] setpgid(0, 0) = 0 [pid 5869] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5869] write(3, "1000", 4) = 4 [pid 5869] close(3) = 0 [pid 5869] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5869] write(1, "executing program\n", 18) = 18 [pid 5869] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5869] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5869] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5869] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5869] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5869] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5869] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5870 attached [pid 5870] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5869] <... clone3 resumed> => {parent_tid=[5870]}, 88) = 5870 [pid 5870] set_robust_list(0x7fe178e1b9a0, 24 [pid 5869] rt_sigprocmask(SIG_SETMASK, [], [pid 5870] <... set_robust_list resumed>) = 0 [pid 5869] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5870] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5869] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5869] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5870] memfd_create("syzkaller", 0) = 3 [pid 5870] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5870] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5870] munmap(0x7fe170800000, 138412032) = 0 [pid 5870] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5870] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5870] close(3) = 0 [pid 5870] close(4) = 0 [pid 5870] mkdir("./file0", 0777) = 0 [ 93.752445][ T5870] loop0: detected capacity change from 0 to 32768 [ 93.768786][ T5870] (syz-executor127,5870,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 93.782963][ T5870] (syz-executor127,5870,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [pid 5870] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5870] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5870] chdir("./file0") = 0 [pid 5870] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5870] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5869] <... futex resumed>) = 0 [pid 5870] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5869] exit_group(0 [pid 5870] <... futex resumed>) = ? [pid 5869] <... exit_group resumed>) = ? [pid 5870] +++ exited with 0 +++ [pid 5869] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5869, si_uid=0, si_status=0, si_utime=4 /* 0.04 s */, si_stime=13 /* 0.13 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [ 93.801857][ T5870] JBD2: Ignoring recovery information on journal [ 93.820464][ T5870] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 93.831597][ T12] ocfs2: Finishing quota recovery on device (7,0) for slot 0 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./10/binderfs") = 0 umount2("./10/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./10/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./10/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./10/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./10/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./10") = 0 mkdir("./11", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 93.951484][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555586e68690) = 5873 ./strace-static-x86_64: Process 5873 attached [pid 5873] set_robust_list(0x555586e686a0, 24) = 0 [pid 5873] chdir("./11") = 0 [pid 5873] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5873] setpgid(0, 0) = 0 [pid 5873] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5873] write(3, "1000", 4) = 4 [pid 5873] close(3) = 0 [pid 5873] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5873] write(1, "executing program\n", 18executing program ) = 18 [pid 5873] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5873] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5873] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5873] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5873] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5873] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5873] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5874 attached [pid 5874] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5874] set_robust_list(0x7fe178e1b9a0, 24 [pid 5873] <... clone3 resumed> => {parent_tid=[5874]}, 88) = 5874 [pid 5874] <... set_robust_list resumed>) = 0 [pid 5873] rt_sigprocmask(SIG_SETMASK, [], [pid 5874] rt_sigprocmask(SIG_SETMASK, [], [pid 5873] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5874] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5873] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5874] memfd_create("syzkaller", 0 [pid 5873] <... futex resumed>) = 0 [pid 5873] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5874] <... memfd_create resumed>) = 3 [pid 5874] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5874] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5874] munmap(0x7fe170800000, 138412032) = 0 [pid 5874] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5874] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5874] close(3) = 0 [pid 5874] close(4) = 0 [pid 5874] mkdir("./file0", 0777) = 0 [ 94.287943][ T5874] loop0: detected capacity change from 0 to 32768 [ 94.319199][ T5874] (syz-executor127,5874,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 94.333201][ T5874] (syz-executor127,5874,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 94.352102][ T5874] JBD2: Ignoring recovery information on journal [ 94.373800][ T5874] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [pid 5874] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5874] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5874] chdir("./file0") = 0 [pid 5874] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5874] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5873] <... futex resumed>) = 0 [pid 5874] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5873] exit_group(0 [pid 5874] <... futex resumed>) = ? [pid 5873] <... exit_group resumed>) = ? [pid 5874] +++ exited with 0 +++ [pid 5873] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5873, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=14 /* 0.14 s */} --- [ 94.385456][ T69] ocfs2: Finishing quota recovery on device (7,0) for slot 0 umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./11/binderfs") = 0 umount2("./11/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./11/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./11/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./11/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./11/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./11") = 0 mkdir("./12", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 94.525015][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555586e68690) = 5877 ./strace-static-x86_64: Process 5877 attached [pid 5877] set_robust_list(0x555586e686a0, 24) = 0 [pid 5877] chdir("./12") = 0 [pid 5877] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5877] setpgid(0, 0) = 0 [pid 5877] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5877] write(3, "1000", 4) = 4 [pid 5877] close(3) = 0 [pid 5877] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5877] write(1, "executing program\n", 18) = 18 [pid 5877] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5877] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5877] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5877] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5877] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5877] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5877] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5878 attached [pid 5878] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5877] <... clone3 resumed> => {parent_tid=[5878]}, 88) = 5878 [pid 5878] set_robust_list(0x7fe178e1b9a0, 24 [pid 5877] rt_sigprocmask(SIG_SETMASK, [], [pid 5878] <... set_robust_list resumed>) = 0 [pid 5877] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5878] rt_sigprocmask(SIG_SETMASK, [], [pid 5877] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5878] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5878] memfd_create("syzkaller", 0 [pid 5877] <... futex resumed>) = 0 [pid 5877] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5878] <... memfd_create resumed>) = 3 [pid 5878] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5878] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5878] munmap(0x7fe170800000, 138412032) = 0 [pid 5878] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5878] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5878] close(3) = 0 [pid 5878] close(4) = 0 [pid 5878] mkdir("./file0", 0777) = 0 [ 94.886565][ T5878] loop0: detected capacity change from 0 to 32768 [ 94.928587][ T5878] (syz-executor127,5878,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 94.942900][ T5878] (syz-executor127,5878,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [pid 5878] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5878] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5878] chdir("./file0") = 0 [pid 5878] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5878] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5877] <... futex resumed>) = 0 [pid 5878] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5877] exit_group(0 [pid 5878] <... futex resumed>) = ? [pid 5877] <... exit_group resumed>) = ? [pid 5878] +++ exited with 0 +++ [pid 5877] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5877, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=15 /* 0.15 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 94.973017][ T5878] JBD2: Ignoring recovery information on journal [ 94.991375][ T5878] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 95.002808][ T12] ocfs2: Finishing quota recovery on device (7,0) for slot 0 openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./12/binderfs") = 0 umount2("./12/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./12/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./12/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./12/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./12/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./12") = 0 mkdir("./13", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 95.148536][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5881 attached [pid 5881] set_robust_list(0x555586e686a0, 24 [pid 5826] <... clone resumed>, child_tidptr=0x555586e68690) = 5881 [pid 5881] <... set_robust_list resumed>) = 0 [pid 5881] chdir("./13") = 0 [pid 5881] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5881] setpgid(0, 0) = 0 [pid 5881] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5881] write(3, "1000", 4) = 4 [pid 5881] close(3) = 0 [pid 5881] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5881] write(1, "executing program\n", 18) = 18 [pid 5881] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5881] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5881] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5881] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5881] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5881] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5881] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5882 attached [pid 5882] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5881] <... clone3 resumed> => {parent_tid=[5882]}, 88) = 5882 [pid 5882] set_robust_list(0x7fe178e1b9a0, 24 [pid 5881] rt_sigprocmask(SIG_SETMASK, [], [pid 5882] <... set_robust_list resumed>) = 0 [pid 5881] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5882] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5881] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5882] memfd_create("syzkaller", 0 [pid 5881] <... futex resumed>) = 0 [pid 5881] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5882] <... memfd_create resumed>) = 3 [pid 5882] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5882] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5882] munmap(0x7fe170800000, 138412032) = 0 [pid 5882] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5882] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5882] close(3) = 0 [pid 5882] close(4) = 0 [pid 5882] mkdir("./file0", 0777) = 0 [ 95.501514][ T5882] loop0: detected capacity change from 0 to 32768 [ 95.523431][ T5882] (syz-executor127,5882,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 95.537587][ T5882] (syz-executor127,5882,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [pid 5882] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5882] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5882] chdir("./file0") = 0 [pid 5882] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5882] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5881] <... futex resumed>) = 0 [pid 5882] <... futex resumed>) = 1 [pid 5881] exit_group(0 [pid 5882] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5881] <... exit_group resumed>) = ? [pid 5882] <... futex resumed>) = ? [pid 5882] +++ exited with 0 +++ [pid 5881] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5881, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=12 /* 0.12 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./13/binderfs") = 0 [ 95.555404][ T5882] JBD2: Ignoring recovery information on journal [ 95.574938][ T5882] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 95.586582][ T12] ocfs2: Finishing quota recovery on device (7,0) for slot 0 umount2("./13/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./13/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./13/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./13/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./13/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./13") = 0 mkdir("./14", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 95.622813][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5885 attached [pid 5885] set_robust_list(0x555586e686a0, 24 [pid 5826] <... clone resumed>, child_tidptr=0x555586e68690) = 5885 [pid 5885] <... set_robust_list resumed>) = 0 [pid 5885] chdir("./14") = 0 [pid 5885] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5885] setpgid(0, 0) = 0 [pid 5885] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5885] write(3, "1000", 4) = 4 [pid 5885] close(3) = 0 [pid 5885] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5885] write(1, "executing program\n", 18executing program ) = 18 [pid 5885] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5885] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5885] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5885] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5885] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5885] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5885] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5886 attached [pid 5886] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053 [pid 5885] <... clone3 resumed> => {parent_tid=[5886]}, 88) = 5886 [pid 5886] <... rseq resumed>) = 0 [pid 5886] set_robust_list(0x7fe178e1b9a0, 24) = 0 [pid 5885] rt_sigprocmask(SIG_SETMASK, [], [pid 5886] rt_sigprocmask(SIG_SETMASK, [], [pid 5885] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5886] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5885] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5886] memfd_create("syzkaller", 0 [pid 5885] <... futex resumed>) = 0 [pid 5885] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5886] <... memfd_create resumed>) = 3 [pid 5886] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5886] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5886] munmap(0x7fe170800000, 138412032) = 0 [pid 5886] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5886] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5886] close(3) = 0 [pid 5886] close(4) = 0 [pid 5886] mkdir("./file0", 0777) = 0 [ 95.998361][ T5886] loop0: detected capacity change from 0 to 32768 [ 96.020081][ T5886] (syz-executor127,5886,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [pid 5886] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [ 96.043065][ T5886] (syz-executor127,5886,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 96.061399][ T5886] JBD2: Ignoring recovery information on journal [ 96.081366][ T5886] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [pid 5886] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5886] chdir("./file0") = 0 [pid 5886] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5886] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5885] <... futex resumed>) = 0 [pid 5886] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5885] exit_group(0 [pid 5886] <... futex resumed>) = ? [pid 5885] <... exit_group resumed>) = ? [pid 5886] +++ exited with 0 +++ [pid 5885] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5885, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=14 /* 0.14 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 96.093555][ T12] ocfs2: Finishing quota recovery on device (7,0) for slot 0 newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./14/binderfs") = 0 umount2("./14/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./14/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./14/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./14/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./14/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./14") = 0 mkdir("./15", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 [ 96.182414][ T5826] ocfs2: Unmounting device (7,0) on (node local) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5889 attached [pid 5889] set_robust_list(0x555586e686a0, 24 [pid 5826] <... clone resumed>, child_tidptr=0x555586e68690) = 5889 [pid 5889] <... set_robust_list resumed>) = 0 [pid 5889] chdir("./15") = 0 [pid 5889] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5889] setpgid(0, 0) = 0 [pid 5889] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5889] write(3, "1000", 4) = 4 [pid 5889] close(3) = 0 [pid 5889] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 5889] write(1, "executing program\n", 18) = 18 [pid 5889] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5889] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5889] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5889] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5889] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5889] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5889] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5890 attached [pid 5890] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5889] <... clone3 resumed> => {parent_tid=[5890]}, 88) = 5890 [pid 5890] set_robust_list(0x7fe178e1b9a0, 24 [pid 5889] rt_sigprocmask(SIG_SETMASK, [], [pid 5890] <... set_robust_list resumed>) = 0 [pid 5889] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5890] rt_sigprocmask(SIG_SETMASK, [], [pid 5889] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5890] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5889] <... futex resumed>) = 0 [pid 5889] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5890] memfd_create("syzkaller", 0) = 3 [pid 5890] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5890] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5890] munmap(0x7fe170800000, 138412032) = 0 [pid 5890] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5890] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5890] close(3) = 0 [pid 5890] close(4) = 0 [pid 5890] mkdir("./file0", 0777) = 0 [ 96.494033][ T5890] loop0: detected capacity change from 0 to 32768 [ 96.532473][ T5890] (syz-executor127,5890,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 96.546883][ T5890] (syz-executor127,5890,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 96.565589][ T5890] JBD2: Ignoring recovery information on journal [ 96.585270][ T5890] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [pid 5890] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5890] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5890] chdir("./file0") = 0 [pid 5890] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5890] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5889] <... futex resumed>) = 0 [pid 5890] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5889] exit_group(0 [pid 5890] <... futex resumed>) = ? [pid 5889] <... exit_group resumed>) = ? [pid 5890] +++ exited with 0 +++ [pid 5889] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5889, si_uid=0, si_status=0, si_utime=4 /* 0.04 s */, si_stime=11 /* 0.11 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 [ 96.598975][ T69] ocfs2: Finishing quota recovery on device (7,0) for slot 0 umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./15/binderfs") = 0 umount2("./15/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0 umount2("./15/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./15/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./15/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./15/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x555586e71770 /* 2 entries */, 32768) = 48 getdents64(4, 0x555586e71770 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./15/file0") = 0 getdents64(3, 0x555586e69730 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./15") = 0 [ 96.792939][ T5826] ocfs2: Unmounting device (7,0) on (node local) mkdir("./16", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5893 attached [pid 5893] set_robust_list(0x555586e686a0, 24 [pid 5826] <... clone resumed>, child_tidptr=0x555586e68690) = 5893 [pid 5893] <... set_robust_list resumed>) = 0 [pid 5893] chdir("./16") = 0 [pid 5893] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5893] setpgid(0, 0) = 0 [pid 5893] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5893] write(3, "1000", 4) = 4 [pid 5893] close(3) = 0 [pid 5893] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5893] write(1, "executing program\n", 18executing program ) = 18 [pid 5893] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5893] rt_sigaction(SIGRT_1, {sa_handler=0x7fe178e8cf30, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fe178e7e0e0}, NULL, 8) = 0 [pid 5893] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5893] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fe178dfb000 [pid 5893] mprotect(0x7fe178dfc000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5893] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5893] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fe178e1b990, parent_tid=0x7fe178e1b990, exit_signal=0, stack=0x7fe178dfb000, stack_size=0x20300, tls=0x7fe178e1b6c0}./strace-static-x86_64: Process 5894 attached [pid 5894] rseq(0x7fe178e1bfe0, 0x20, 0, 0x53053053) = 0 [pid 5893] <... clone3 resumed> => {parent_tid=[5894]}, 88) = 5894 [pid 5894] set_robust_list(0x7fe178e1b9a0, 24 [pid 5893] rt_sigprocmask(SIG_SETMASK, [], [pid 5894] <... set_robust_list resumed>) = 0 [pid 5893] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5894] rt_sigprocmask(SIG_SETMASK, [], [pid 5893] futex(0x7fe178ef36a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5894] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5893] <... futex resumed>) = 0 [pid 5893] futex(0x7fe178ef36ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5894] memfd_create("syzkaller", 0) = 3 [pid 5894] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe170800000 [pid 5894] write(3, "\x02\x02\x02\x02\x02\x02\x02\x02\x74\x68\x69\x73\x20\x69\x73\x20\x61\x6e\x20\x6f\x63\x66\x73\x32\x20\x76\x6f\x6c\x75\x6d\x65\x00\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"..., 16777216) = 16777216 [pid 5894] munmap(0x7fe170800000, 138412032) = 0 [pid 5894] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5894] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5894] close(3) = 0 [pid 5894] close(4) = 0 [pid 5894] mkdir("./file0", 0777) = 0 [ 97.233330][ T5894] loop0: detected capacity change from 0 to 32768 [ 97.254608][ T5894] (syz-executor127,5894,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [pid 5894] mount("/dev/loop0", "./file0", "ocfs2", MS_RELATIME, "usrquota,coherency=full,errors=continue,heartbeat=none,errors=continue,nointr,grpquota,") = 0 [pid 5894] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5894] chdir("./file0") = 0 [pid 5894] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5894] futex(0x7fe178ef36ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5893] <... futex resumed>) = 0 [pid 5894] <... futex resumed>) = 1 [pid 5893] exit_group(0 [pid 5894] futex(0x7fe178ef36a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5893] <... exit_group resumed>) = ? [pid 5894] <... futex resumed>) = ? [pid 5894] +++ exited with 0 +++ [pid 5893] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5893, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=13 /* 0.13 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 [ 97.275053][ T5894] (syz-executor127,5894,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 97.293725][ T5894] JBD2: Ignoring recovery information on journal [ 97.313655][ T5894] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 97.325170][ T12] ocfs2: Finishing quota recovery on device (7,0) for slot 0 umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x555586e69730 /* 4 entries */, 32768) = 112 umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0