./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor375183911

<...>
no interfaces have a carrier
forked to background, child pid 4708
[   43.423769][ T4709] 8021q: adding VLAN 0 to HW filter on device bond0
[   43.445037][ T4709] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.1.182' (ED25519) to the list of known hosts.
execve("./syz-executor375183911", ["./syz-executor375183911"], 0x7fffb88ddda0 /* 10 vars */) = 0
brk(NULL)                               = 0x555555fe7000
brk(0x555555fe7d00)                     = 0x555555fe7d00
arch_prctl(ARCH_SET_FS, 0x555555fe7380) = 0
set_tid_address(0x555555fe7650)         = 5040
set_robust_list(0x555555fe7660, 24)     = 0
rseq(0x555555fe7ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor375183911", 4096) = 27
getrandom("\xd6\x58\x52\x9c\x66\x70\xfd\x14", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555555fe7d00
brk(0x555556008d00)                     = 0x555556008d00
brk(0x555556009000)                     = 0x555556009000
mprotect(0x7fdff6db3000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555fe7650) = 5041
./strace-static-x86_64: Process 5041 attached
[pid  5040] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5041] set_robust_list(0x555555fe7660, 24) = 0
[pid  5041] openat(AT_FDCWD, "/dev/loop0", O_RDWR./strace-static-x86_64: Process 5042 attached
 <unfinished ...>
[pid  5040] <... clone resumed>, child_tidptr=0x555555fe7650) = 5042
[pid  5041] <... openat resumed>)       = 3
[pid  5042] set_robust_list(0x555555fe7660, 24 <unfinished ...>
[pid  5041] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  5042] <... set_robust_list resumed>) = 0
[pid  5040] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5042] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  5041] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
./strace-static-x86_64: Process 5043 attached
[pid  5040] <... clone resumed>, child_tidptr=0x555555fe7650) = 5043
[pid  5041] close(3 <unfinished ...>
[pid  5040] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5043] set_robust_list(0x555555fe7660, 24 <unfinished ...>
[pid  5042] <... openat resumed>)       = 3
[pid  5041] <... close resumed>)        = 0
[pid  5042] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  5042] close(3)                    = 0
[pid  5042] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5044 attached
, child_tidptr=0x555555fe7650) = 5044
[pid  5044] set_robust_list(0x555555fe7660, 24./strace-static-x86_64: Process 5045 attached
 <unfinished ...>
[pid  5043] <... set_robust_list resumed>) = 0
[pid  5041] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5040] <... clone resumed>, child_tidptr=0x555555fe7650) = 5045
[pid  5044] <... set_robust_list resumed>) = 0
[pid  5044] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5044] setpgid(0, 0)               = 0
[pid  5044] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5040] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5044] write(3, "1000", 4)         = 4
[pid  5044] close(3)                    = 0
[pid  5044] memfd_create("syzkaller", 0./strace-static-x86_64: Process 5047 attached
 <unfinished ...>
[pid  5045] set_robust_list(0x555555fe7660, 24 <unfinished ...>
[pid  5043] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  5040] <... clone resumed>, child_tidptr=0x555555fe7650) = 5047
[pid  5045] <... set_robust_list resumed>) = 0
[pid  5041] <... clone resumed>, child_tidptr=0x555555fe7650) = 5046
./strace-static-x86_64: Process 5046 attached
[pid  5046] set_robust_list(0x555555fe7660, 24) = 0
[pid  5046] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5046] setpgid(0, 0)               = 0
[pid  5046] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  5040] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5046] <... openat resumed>)       = 3
[pid  5043] <... openat resumed>)       = 3
[pid  5046] write(3, "1000", 4 <unfinished ...>
[pid  5045] openat(AT_FDCWD, "/dev/loop3", O_RDWR <unfinished ...>
[pid  5046] <... write resumed>)        = 4
[pid  5046] close(3)                    = 0
[pid  5046] memfd_create("syzkaller", 0) = 3
[pid  5046] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdfee8fd000
[pid  5047] set_robust_list(0x555555fe7660, 24 <unfinished ...>
[pid  5045] <... openat resumed>)       = 3
[pid  5043] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  5047] <... set_robust_list resumed>) = 0
./strace-static-x86_64: Process 5048 attached
[pid  5048] set_robust_list(0x555555fe7660, 24) = 0
[pid  5047] openat(AT_FDCWD, "/dev/loop4", O_RDWR <unfinished ...>
[pid  5048] openat(AT_FDCWD, "/dev/loop5", O_RDWR <unfinished ...>
[pid  5040] <... clone resumed>, child_tidptr=0x555555fe7650) = 5048
[pid  5043] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  5048] <... openat resumed>)       = 3
[pid  5047] <... openat resumed>)       = 3
[pid  5045] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  5044] <... memfd_create resumed>) = 3
[pid  5043] close(3 <unfinished ...>
[pid  5047] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  5043] <... close resumed>)        = 0
[pid  5045] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  5048] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  5043] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5048] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  5045] close(3 <unfinished ...>
[pid  5048] close(3)                    = 0
[pid  5045] <... close resumed>)        = 0
[pid  5045] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5048] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5044] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdfee8fd000
[pid  5047] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  5048] <... clone resumed>, child_tidptr=0x555555fe7650) = 5051
syzkaller login: [   69.900243][ T5044] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5044 'syz-executor375'
./strace-static-x86_64: Process 5052 attached
./strace-static-x86_64: Process 5050 attached
[pid  5047] close(3 <unfinished ...>
[pid  5045] <... clone resumed>, child_tidptr=0x555555fe7650) = 5050
[pid  5043] <... clone resumed>, child_tidptr=0x555555fe7650) = 5052
[pid  5050] set_robust_list(0x555555fe7660, 24 <unfinished ...>
[pid  5047] <... close resumed>)        = 0
[pid  5052] set_robust_list(0x555555fe7660, 24 <unfinished ...>
[pid  5050] <... set_robust_list resumed>) = 0
[pid  5047] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5052] <... set_robust_list resumed>) = 0
[pid  5052] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 5051 attached
 <unfinished ...>
[pid  5051] set_robust_list(0x555555fe7660, 24) = 0
[pid  5051] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5050] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  5051] setpgid(0, 0)               = 0
[pid  5051] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  5052] <... prctl resumed>)        = 0
[pid  5050] <... prctl resumed>)        = 0
[pid  5051] <... openat resumed>)       = 3
[pid  5052] setpgid(0, 0)               = 0
[pid  5052] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  5051] write(3, "1000", 4)         = 4
[pid  5051] close(3)                    = 0
[pid  5050] setpgid(0, 0 <unfinished ...>
[pid  5052] <... openat resumed>)       = 3
[pid  5050] <... setpgid resumed>)      = 0
[pid  5051] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5052] write(3, "1000", 4 <unfinished ...>
[pid  5047] <... clone resumed>, child_tidptr=0x555555fe7650) = 5053
[pid  5052] <... write resumed>)        = 4
[pid  5050] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  5052] close(3)                    = 0
[pid  5050] <... openat resumed>)       = 3
[pid  5051] <... memfd_create resumed>) = 3
[pid  5051] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdfee8fd000
[pid  5052] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5050] write(3, "1000", 4./strace-static-x86_64: Process 5053 attached
 <unfinished ...>
[pid  5053] set_robust_list(0x555555fe7660, 24) = 0
[pid  5053] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5053] setpgid(0, 0)               = 0
[pid  5053] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5053] write(3, "1000", 4)         = 4
[pid  5053] close(3 <unfinished ...>
[pid  5050] <... write resumed>)        = 4
[pid  5050] close(3 <unfinished ...>
[pid  5052] <... memfd_create resumed>) = 3
[pid  5052] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  5050] <... close resumed>)        = 0
[pid  5053] <... close resumed>)        = 0
[pid  5050] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5053] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5052] <... mmap resumed>)         = 0x7fdfee8fd000
[pid  5050] <... memfd_create resumed>) = 3
[pid  5050] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  5053] <... memfd_create resumed>) = 3
[pid  5050] <... mmap resumed>)         = 0x7fdfee8fd000
[pid  5053] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdfee8fd000
[pid  5046] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216 <unfinished ...>
[pid  5052] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216 <unfinished ...>
[pid  5050] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216 <unfinished ...>
[pid  5044] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216 <unfinished ...>
[pid  5051] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216 <unfinished ...>
[pid  5053] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216 <unfinished ...>
[pid  5052] <... write resumed>)        = 16777216
[pid  5052] munmap(0x7fdfee8fd000, 16777216) = 0
[pid  5053] <... write resumed>)        = 16777216
[pid  5052] openat(AT_FDCWD, "/dev/loop2", O_RDWR <unfinished ...>
[pid  5050] <... write resumed>)        = 16777216
[pid  5050] munmap(0x7fdfee8fd000, 16777216 <unfinished ...>
[pid  5052] <... openat resumed>)       = 4
[pid  5052] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5053] munmap(0x7fdfee8fd000, 16777216 <unfinished ...>
[pid  5050] <... munmap resumed>)       = 0
[pid  5053] <... munmap resumed>)       = 0
[pid  5052] <... ioctl resumed>)        = 0
[pid  5050] openat(AT_FDCWD, "/dev/loop3", O_RDWR <unfinished ...>
[pid  5046] <... write resumed>)        = 16777216
[pid  5050] <... openat resumed>)       = 4
[pid  5050] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5046] munmap(0x7fdfee8fd000, 16777216 <unfinished ...>
[pid  5052] close(3)                    = 0
[pid  5052] mkdir("./file0", 0777 <unfinished ...>
[pid  5053] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4
[pid  5053] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5052] <... mkdir resumed>)        = 0
[pid  5050] <... ioctl resumed>)        = 0
[pid  5046] <... munmap resumed>)       = 0
[pid  5044] <... write resumed>)        = 16777216
[pid  5052] mount("/dev/loop2", "./file0", "btrfs", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS, "nossd_spread,nodatacow,usebackuproot,notreelog,nodatasum,autodefrag,user_subvol_rm_allowed," <unfinished ...>
[pid  5050] close(3 <unfinished ...>
[pid  5053] <... ioctl resumed>)        = 0
[pid  5050] <... close resumed>)        = 0
[pid  5050] mkdir("./file0", 0777)      = -1 EEXIST (File exists)
[pid  5044] munmap(0x7fdfee8fd000, 16777216 <unfinished ...>
[pid  5053] close(3)                    = 0
[pid  5053] mkdir("./file0", 0777)      = -1 EEXIST (File exists)
[   70.954201][ T5052] loop2: detected capacity change from 0 to 32768
[   70.971340][ T5050] loop3: detected capacity change from 0 to 32768
[   70.986769][ T5053] loop4: detected capacity change from 0 to 32768
[pid  5053] mount("/dev/loop4", "./file0", "btrfs", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS, "nossd_spread,nodatacow,usebackuproot,notreelog,nodatasum,autodefrag,user_subvol_rm_allowed," <unfinished ...>
[pid  5050] mount("/dev/loop3", "./file0", "btrfs", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS, "nossd_spread,nodatacow,usebackuproot,notreelog,nodatasum,autodefrag,user_subvol_rm_allowed," <unfinished ...>
[pid  5051] <... write resumed>)        = 16777216
[pid  5046] openat(AT_FDCWD, "/dev/loop0", O_RDWR <unfinished ...>
[pid  5044] <... munmap resumed>)       = 0
[pid  5051] munmap(0x7fdfee8fd000, 16777216 <unfinished ...>
[pid  5044] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  5046] <... openat resumed>)       = 4
[pid  5044] <... openat resumed>)       = 4
[pid  5046] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5044] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5051] <... munmap resumed>)       = 0
[pid  5046] <... ioctl resumed>)        = 0
[pid  5044] <... ioctl resumed>)        = 0
[pid  5051] openat(AT_FDCWD, "/dev/loop5", O_RDWR <unfinished ...>
[pid  5046] close(3 <unfinished ...>
[pid  5044] close(3 <unfinished ...>
[pid  5051] <... openat resumed>)       = 4
[pid  5046] <... close resumed>)        = 0
[pid  5044] <... close resumed>)        = 0
[pid  5051] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5046] mkdir("./file0", 0777 <unfinished ...>
[pid  5044] mkdir("./file0", 0777 <unfinished ...>
[pid  5053] <... mount resumed>)        = -1 EEXIST (File exists)
[   70.996636][ T5052] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor375 (5052)
[   71.015797][ T5046] loop0: detected capacity change from 0 to 32768
[   71.016090][ T5044] loop1: detected capacity change from 0 to 32768
[   71.025345][ T5053] BTRFS warning: duplicate device /dev/loop4 devid 1 generation 8 scanned by syz-executor375 (5053)
[   71.037025][ T5051] loop5: detected capacity change from 0 to 32768
[pid  5051] <... ioctl resumed>)        = 0
[pid  5046] <... mkdir resumed>)        = -1 EEXIST (File exists)
[pid  5044] <... mkdir resumed>)        = -1 EEXIST (File exists)
[pid  5051] close(3 <unfinished ...>
[pid  5046] mount("/dev/loop0", "./file0", "btrfs", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS, "nossd_spread,nodatacow,usebackuproot,notreelog,nodatasum,autodefrag,user_subvol_rm_allowed," <unfinished ...>
[pid  5044] mount("/dev/loop1", "./file0", "btrfs", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS, "nossd_spread,nodatacow,usebackuproot,notreelog,nodatasum,autodefrag,user_subvol_rm_allowed," <unfinished ...>
[pid  5051] <... close resumed>)        = 0
[pid  5051] mkdir("./file0", 0777)      = -1 EEXIST (File exists)
[pid  5051] mount("/dev/loop5", "./file0", "btrfs", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS, "nossd_spread,nodatacow,usebackuproot,notreelog,nodatasum,autodefrag,user_subvol_rm_allowed," <unfinished ...>
[pid  5053] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5050] <... mount resumed>)        = -1 EEXIST (File exists)
[pid  5050] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5046] <... mount resumed>)        = -1 EEXIST (File exists)
[   71.043348][ T5050] BTRFS warning: duplicate device /dev/loop3 devid 1 generation 8 scanned by syz-executor375 (5050)
[   71.051664][ T5052] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[   71.060400][ T5046] BTRFS warning: duplicate device /dev/loop0 devid 1 generation 8 scanned by syz-executor375 (5046)
[   71.065398][ T5052] BTRFS info (device loop2): setting nodatacow, compression disabled
[   71.081987][ T5044] BTRFS warning: duplicate device /dev/loop1 devid 1 generation 8 scanned by syz-executor375 (5044)
[pid  5046] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5044] <... mount resumed>)        = -1 EEXIST (File exists)
[pid  5044] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5051] <... mount resumed>)        = -1 EEXIST (File exists)
[   71.084457][ T5052] BTRFS warning (device loop2): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead
[   71.105868][ T5052] BTRFS info (device loop2): trying to use backup root at mount time
[   71.114053][ T5052] BTRFS info (device loop2): disabling tree log
[   71.120392][ T5052] BTRFS info (device loop2): enabling auto defrag
[   71.127765][ T5052] BTRFS info (device loop2): using free space tree
[   71.134469][ T5051] BTRFS warning: duplicate device /dev/loop5 devid 1 generation 8 scanned by syz-executor375 (5051)
[   71.296440][   T42] BTRFS warning (device loop2): checksum verify failed on logical 5341184 mirror 1 wanted 0xe51addfa found 0x8d783d47 level 0
[   71.383652][ T5052] BTRFS error (device loop2): failed to load root free space
[   71.398328][ T5052] BTRFS warning (device loop2): try to load backup roots slot 1
[   71.426810][ T5052] BTRFS warning (device loop2): global root 2 0 already exists
[   71.449075][ T5052] BTRFS error (device loop2): failed to load root extent
[   71.473454][ T5052] BTRFS warning (device loop2): try to load backup roots slot 2
[   71.490785][   T48] BTRFS error (device loop2): level verify failed on logical 5255168 mirror 1 wanted 0 found 1
[pid  5051] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5050] <... ioctl resumed>)        = 0
[pid  5050] close(4)                    = 0
[   71.522938][ T5052] BTRFS warning (device loop2): couldn't read tree root
[   71.530289][ T5052] BTRFS warning (device loop2): try to load backup roots slot 3
[   71.542171][ T5052] BTRFS warning (device loop2): global root 2 0 already exists
[pid  5050] exit_group(0)               = ?
[pid  5050] +++ exited with 0 +++
[pid  5045] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5050, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=35 /* 0.35 s */} ---
[pid  5045] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3
[pid  5045] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  5045] close(3)                    = 0
[pid  5045] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555fe7650) = 5070
./strace-static-x86_64: Process 5070 attached
[pid  5070] set_robust_list(0x555555fe7660, 24 <unfinished ...>
[pid  5051] <... ioctl resumed>)        = 0
[pid  5070] <... set_robust_list resumed>) = 0
[pid  5051] close(4 <unfinished ...>
[   71.571190][ T5052] BTRFS error (device loop2): failed to load root extent
[   71.588879][ T5052] BTRFS error (device loop2): open_ctree failed
[pid  5070] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5051] <... close resumed>)        = 0
[pid  5051] exit_group(0 <unfinished ...>
[pid  5070] setpgid(0, 0 <unfinished ...>
[pid  5051] <... exit_group resumed>)   = ?
[pid  5070] <... setpgid resumed>)      = 0
[pid  5070] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5052] <... mount resumed>)        = -1 EEXIST (File exists)
[pid  5070] write(3, "1000", 4 <unfinished ...>
[pid  5052] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5051] +++ exited with 0 +++
[pid  5048] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5051, si_uid=0, si_status=0, si_utime=8 /* 0.08 s */, si_stime=37 /* 0.37 s */} ---
[pid  5070] <... write resumed>)        = 4
[pid  5070] close(3)                    = 0
[pid  5053] <... ioctl resumed>)        = 0
[pid  5070] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5048] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3
[pid  5048] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  5048] close(3)                    = 0
[pid  5070] <... memfd_create resumed>) = 3
[pid  5048] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5070] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdfee8fd000
[pid  5048] <... clone resumed>, child_tidptr=0x555555fe7650) = 5071
[pid  5053] close(4./strace-static-x86_64: Process 5071 attached
 <unfinished ...>
[pid  5071] set_robust_list(0x555555fe7660, 24) = 0
[pid  5053] <... close resumed>)        = 0
[pid  5071] prctl(PR_SET_PDEATHSIG, SIGKILL <unfinished ...>
[pid  5053] exit_group(0 <unfinished ...>
[pid  5071] <... prctl resumed>)        = 0
[pid  5071] setpgid(0, 0 <unfinished ...>
[pid  5053] <... exit_group resumed>)   = ?
[pid  5071] <... setpgid resumed>)      = 0
[pid  5071] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5071] write(3, "1000", 4)         = 4
[pid  5071] close(3)                    = 0
[pid  5071] memfd_create("syzkaller", 0) = 3
[pid  5071] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdfee8fd000
[pid  5053] +++ exited with 0 +++
[pid  5047] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5053, si_uid=0, si_status=0, si_utime=7 /* 0.07 s */, si_stime=35 /* 0.35 s */} ---
[pid  5044] <... ioctl resumed>)        = 0
[pid  5047] restart_syscall(<... resuming interrupted clone ...> <unfinished ...>
[pid  5044] close(4 <unfinished ...>
[pid  5047] <... restart_syscall resumed>) = 0
[pid  5044] <... close resumed>)        = 0
[pid  5044] exit_group(0)               = ?
[pid  5047] openat(AT_FDCWD, "/dev/loop4", O_RDWR <unfinished ...>
[pid  5044] +++ exited with 0 +++
[pid  5042] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5044, si_uid=0, si_status=0, si_utime=8 /* 0.08 s */, si_stime=37 /* 0.37 s */} ---
[pid  5047] <... openat resumed>)       = 3
[pid  5047] ioctl(3, LOOP_CLR_FD <unfinished ...>
[pid  5042] openat(AT_FDCWD, "/dev/loop1", O_RDWR <unfinished ...>
[pid  5047] <... ioctl resumed>)        = -1 ENXIO (No such device or address)
[pid  5042] <... openat resumed>)       = 3
[pid  5047] close(3 <unfinished ...>
[pid  5042] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  5042] close(3)                    = 0
[pid  5042] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5047] <... close resumed>)        = 0
[pid  5047] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5042] <... clone resumed>, child_tidptr=0x555555fe7650) = 5072
[pid  5047] <... clone resumed>, child_tidptr=0x555555fe7650) = 5073
./strace-static-x86_64: Process 5073 attached
[pid  5073] set_robust_list(0x555555fe7660, 24) = 0
./strace-static-x86_64: Process 5072 attached
[pid  5073] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5072] set_robust_list(0x555555fe7660, 24) = 0
[pid  5072] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5073] setpgid(0, 0)               = 0
[pid  5073] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  5072] setpgid(0, 0)               = 0
[pid  5073] <... openat resumed>)       = 3
[pid  5072] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC <unfinished ...>
[pid  5073] write(3, "1000", 4 <unfinished ...>
[pid  5072] <... openat resumed>)       = 3
[pid  5073] <... write resumed>)        = 4
[pid  5072] write(3, "1000", 4 <unfinished ...>
[pid  5073] close(3 <unfinished ...>
[pid  5072] <... write resumed>)        = 4
[pid  5073] <... close resumed>)        = 0
[pid  5072] close(3)                    = 0
[pid  5072] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5073] memfd_create("syzkaller", 0 <unfinished ...>
[pid  5072] <... memfd_create resumed>) = 3
[pid  5072] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdfee8fd000
[pid  5073] <... memfd_create resumed>) = 3
[pid  5073] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...>
[pid  5046] <... ioctl resumed>)        = 0
[pid  5046] close(4)                    = 0
[pid  5046] exit_group(0)               = ?
[pid  5073] <... mmap resumed>)         = 0x7fdfee8fd000
[pid  5046] +++ exited with 0 +++
[pid  5041] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5046, si_uid=0, si_status=0, si_utime=10 /* 0.10 s */, si_stime=38 /* 0.38 s */} ---
[pid  5041] restart_syscall(<... resuming interrupted clone ...>) = 0
[pid  5041] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
[pid  5041] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  5041] close(3)                    = 0
[pid  5041] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555fe7650) = 5074
./strace-static-x86_64: Process 5074 attached
[pid  5074] set_robust_list(0x555555fe7660, 24) = 0
[pid  5074] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5074] setpgid(0, 0)               = 0
[pid  5074] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5074] write(3, "1000", 4)         = 4
[pid  5074] close(3)                    = 0
[pid  5074] memfd_create("syzkaller", 0) = 3
[pid  5074] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdfee8fd000
[pid  5071] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216 <unfinished ...>
[pid  5070] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216 <unfinished ...>
[pid  5072] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216 <unfinished ...>
[pid  5073] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216 <unfinished ...>
[pid  5052] <... ioctl resumed>)        = 0
[pid  5052] close(4)                    = 0
[pid  5052] exit_group(0)               = ?
[pid  5052] +++ exited with 0 +++
[pid  5043] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5052, si_uid=0, si_status=0, si_utime=12 /* 0.12 s */, si_stime=56 /* 0.56 s */} ---
[pid  5043] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3
[pid  5043] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  5043] close(3)                    = 0
[pid  5043] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5075 attached
 <unfinished ...>
[pid  5075] set_robust_list(0x555555fe7660, 24 <unfinished ...>
[pid  5043] <... clone resumed>, child_tidptr=0x555555fe7650) = 5075
[pid  5075] <... set_robust_list resumed>) = 0
[pid  5075] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5075] setpgid(0, 0)               = 0
[pid  5075] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5075] write(3, "1000", 4)         = 4
[pid  5075] close(3)                    = 0
[pid  5075] memfd_create("syzkaller", 0) = 3
[pid  5075] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdfee8fd000
[pid  5074] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216 <unfinished ...>
[pid  5075] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216 <unfinished ...>
[pid  5070] <... write resumed>)        = 16777216
[pid  5070] munmap(0x7fdfee8fd000, 16777216 <unfinished ...>
[pid  5071] <... write resumed>)        = 16777216
[pid  5070] <... munmap resumed>)       = 0
[pid  5070] openat(AT_FDCWD, "/dev/loop3", O_RDWR <unfinished ...>
[pid  5071] munmap(0x7fdfee8fd000, 16777216 <unfinished ...>
[pid  5070] <... openat resumed>)       = 4
[pid  5070] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5071] <... munmap resumed>)       = 0
[pid  5071] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4
[pid  5071] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5070] <... ioctl resumed>)        = 0
[pid  5070] close(3)                    = 0
[pid  5070] mkdir("./file0", 0777 <unfinished ...>
[pid  5071] <... ioctl resumed>)        = 0
[pid  5070] <... mkdir resumed>)        = -1 EEXIST (File exists)
[pid  5071] close(3)                    = 0
[   72.706935][ T5070] loop3: detected capacity change from 0 to 32768
[   72.720309][ T5071] loop5: detected capacity change from 0 to 32768
[pid  5071] mkdir("./file0", 0777)      = -1 EEXIST (File exists)
[pid  5070] mount("/dev/loop3", "./file0", "btrfs", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS, "nossd_spread,nodatacow,usebackuproot,notreelog,nodatasum,autodefrag,user_subvol_rm_allowed," <unfinished ...>
[   72.754805][ T5071] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor375 (5071)
[   72.786259][ T5070] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[pid  5071] mount("/dev/loop5", "./file0", "btrfs", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS, "nossd_spread,nodatacow,usebackuproot,notreelog,nodatasum,autodefrag,user_subvol_rm_allowed," <unfinished ...>
[pid  5072] <... write resumed>)        = 16777216
[pid  5072] munmap(0x7fdfee8fd000, 16777216 <unfinished ...>
[pid  5073] <... write resumed>)        = 16777216
[pid  5072] <... munmap resumed>)       = 0
[pid  5072] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4
[   72.806842][ T5070] BTRFS info (device loop3): setting nodatacow, compression disabled
[   72.832994][ T5070] BTRFS warning (device loop3): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead
[   72.841619][ T5072] loop1: detected capacity change from 0 to 32768
[pid  5072] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5073] munmap(0x7fdfee8fd000, 16777216 <unfinished ...>
[pid  5072] <... ioctl resumed>)        = 0
[pid  5072] close(3)                    = 0
[pid  5072] mkdir("./file0", 0777)      = -1 EEXIST (File exists)
[pid  5072] mount("/dev/loop1", "./file0", "btrfs", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS, "nossd_spread,nodatacow,usebackuproot,notreelog,nodatasum,autodefrag,user_subvol_rm_allowed," <unfinished ...>
[pid  5073] <... munmap resumed>)       = 0
[pid  5073] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4
[pid  5073] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5072] <... mount resumed>)        = -1 EEXIST (File exists)
[pid  5072] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5073] <... ioctl resumed>)        = 0
[pid  5073] close(3)                    = 0
[pid  5073] mkdir("./file0", 0777)      = -1 EEXIST (File exists)
[   72.850744][ T5070] BTRFS info (device loop3): trying to use backup root at mount time
[   72.862371][ T5072] BTRFS warning: duplicate device /dev/loop1 devid 1 generation 8 scanned by syz-executor375 (5072)
[   72.872929][ T5070] BTRFS info (device loop3): disabling tree log
[   72.875064][ T5073] loop4: detected capacity change from 0 to 32768
[   72.879715][ T5070] BTRFS info (device loop3): enabling auto defrag
[   72.893481][ T5070] BTRFS info (device loop3): using free space tree
[pid  5073] mount("/dev/loop4", "./file0", "btrfs", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS, "nossd_spread,nodatacow,usebackuproot,notreelog,nodatasum,autodefrag,user_subvol_rm_allowed,") = -1 EEXIST (File exists)
[pid  5073] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5074] <... write resumed>)        = 16777216
[pid  5074] munmap(0x7fdfee8fd000, 16777216) = 0
[pid  5074] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   72.917271][ T5073] BTRFS warning: duplicate device /dev/loop4 devid 1 generation 8 scanned by syz-executor375 (5073)
[   72.956972][ T5074] loop0: detected capacity change from 0 to 32768
[   72.966146][   T48] BTRFS warning (device loop3): checksum verify failed on logical 5341184 mirror 1 wanted 0xe51addfa found 0x8d783d47 level 0
[pid  5074] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5074] close(3)                    = 0
[pid  5074] mkdir("./file0", 0777)      = -1 EEXIST (File exists)
[pid  5074] mount("/dev/loop0", "./file0", "btrfs", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS, "nossd_spread,nodatacow,usebackuproot,notreelog,nodatasum,autodefrag,user_subvol_rm_allowed," <unfinished ...>
[pid  5075] <... write resumed>)        = 16777216
[pid  5075] munmap(0x7fdfee8fd000, 16777216) = 0
[pid  5075] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4
[   73.007768][ T5074] BTRFS warning: duplicate device /dev/loop0 devid 1 generation 8 scanned by syz-executor375 (5074)
[   73.037872][ T5070] BTRFS error (device loop3): failed to load root free space
[   73.038707][ T5075] loop2: detected capacity change from 0 to 32768
[pid  5075] ioctl(4, LOOP_SET_FD, 3 <unfinished ...>
[pid  5074] <... mount resumed>)        = -1 EEXIST (File exists)
[pid  5074] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5075] <... ioctl resumed>)        = 0
[   73.052996][ T5070] BTRFS warning (device loop3): try to load backup roots slot 1
[   73.063342][ T5070] BTRFS warning (device loop3): global root 2 0 already exists
[   73.070940][ T5070] BTRFS error (device loop3): failed to load root extent
[   73.093643][ T5070] BTRFS warning (device loop3): try to load backup roots slot 2
[pid  5075] close(3)                    = 0
[pid  5075] mkdir("./file0", 0777)      = -1 EEXIST (File exists)
[pid  5075] mount("/dev/loop2", "./file0", "btrfs", MS_NOSUID|MS_NODEV|MS_SYNCHRONOUS, "nossd_spread,nodatacow,usebackuproot,notreelog,nodatasum,autodefrag,user_subvol_rm_allowed,") = -1 EEXIST (File exists)
[   73.101742][   T42] BTRFS error (device loop3): level verify failed on logical 5255168 mirror 1 wanted 0 found 1
[   73.114577][ T5075] BTRFS warning: duplicate device /dev/loop2 devid 1 generation 8 scanned by syz-executor375 (5075)
[   73.152994][ T5070] BTRFS warning (device loop3): couldn't read tree root
[   73.159959][ T5070] BTRFS warning (device loop3): try to load backup roots slot 3
[   73.180516][ T5070] BTRFS warning (device loop3): global root 2 0 already exists
[   73.189637][ T5070] BTRFS error (device loop3): failed to load root extent
[   73.238859][ T5070] BTRFS error (device loop3): open_ctree failed
[   73.276982][ T5071] ==================================================================
[   73.285057][ T5071] BUG: KASAN: slab-use-after-free in btrfs_open_devices+0xb8/0xc0
[   73.292872][ T5071] Read of size 4 at addr ffff888021788130 by task syz-executor375/5071
[   73.301107][ T5071] 
[   73.303423][ T5071] CPU: 1 PID: 5071 Comm: syz-executor375 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0
[   73.313316][ T5071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[   73.323369][ T5071] Call Trace:
[   73.326655][ T5071]  <TASK>
[   73.329588][ T5071]  dump_stack_lvl+0xd9/0x1b0
[   73.334203][ T5071]  print_report+0xc4/0x620
[   73.338639][ T5071]  ? __virt_addr_valid+0x5e/0x2d0
[   73.343674][ T5071]  ? __phys_addr+0xc6/0x140
[   73.348192][ T5071]  kasan_report+0xda/0x110
[   73.352626][ T5071]  ? btrfs_open_devices+0xb8/0xc0
[   73.357661][ T5071]  ? btrfs_open_devices+0xb8/0xc0
[   73.362710][ T5071]  btrfs_open_devices+0xb8/0xc0
[   73.367584][ T5071]  btrfs_mount_root+0x681/0xda0
[   73.372448][ T5071]  ? btrfs_sync_fs+0x770/0x770
[   73.377216][ T5071]  ? legacy_parse_param+0x3d4/0x8e0
[   73.382430][ T5071]  ? bpf_lsm_fs_context_parse_param+0x9/0x10
[   73.388416][ T5071]  ? security_fs_context_parse_param+0xa7/0xd0
[   73.394578][ T5071]  ? generic_parse_monolithic+0x1f0/0x1f0
[   73.400315][ T5071]  ? vfs_parse_fs_string+0xfb/0x150
[   73.405526][ T5071]  ? vfs_parse_fs_param+0x3c0/0x3c0
[   73.410737][ T5071]  ? kasan_set_track+0x25/0x30
[   73.415530][ T5071]  ? btrfs_sync_fs+0x770/0x770
[   73.420298][ T5071]  legacy_get_tree+0x109/0x220
[   73.425079][ T5071]  vfs_get_tree+0x88/0x350
[   73.429505][ T5071]  vfs_kern_mount.part.0+0xcb/0x170
[   73.434711][ T5071]  vfs_kern_mount+0x3f/0x60
[   73.439231][ T5071]  btrfs_mount+0x292/0xb10
[   73.443661][ T5071]  ? btrfs_show_options+0x1230/0x1230
[   73.449050][ T5071]  ? vfs_parse_fs_param_source+0x103/0x1e0
[   73.454880][ T5071]  ? legacy_parse_param+0x3d4/0x8e0
[   73.460091][ T5071]  ? bpf_lsm_fs_context_parse_param+0x9/0x10
[   73.466078][ T5071]  ? security_fs_context_parse_param+0xa7/0xd0
[   73.472236][ T5071]  ? generic_parse_monolithic+0x1f0/0x1f0
[   73.477973][ T5071]  ? vfs_parse_fs_string+0xfb/0x150
[   73.483193][ T5071]  ? apparmor_capable+0x1da/0x4e0
[   73.488229][ T5071]  ? btrfs_show_options+0x1230/0x1230
[   73.493611][ T5071]  legacy_get_tree+0x109/0x220
[   73.498394][ T5071]  vfs_get_tree+0x88/0x350
[   73.502820][ T5071]  path_mount+0x1492/0x1ed0
[   73.507336][ T5071]  ? kmem_cache_free+0xf0/0x490
[   73.512199][ T5071]  ? finish_automount+0xa50/0xa50
[   73.517237][ T5071]  ? putname+0x101/0x140
[   73.521486][ T5071]  __x64_sys_mount+0x293/0x310
[   73.526265][ T5071]  ? copy_mnt_ns+0xb60/0xb60
[   73.530865][ T5071]  ? _raw_spin_unlock_irq+0x2e/0x50
[   73.536078][ T5071]  ? ptrace_notify+0xf4/0x130
[   73.540765][ T5071]  do_syscall_64+0x38/0xb0
[   73.545201][ T5071]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   73.551111][ T5071] RIP: 0033:0x7fdff6d3cf9a
[   73.555530][ T5071] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   73.575139][ T5071] RSP: 002b:00007ffc9bed0318 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
[   73.583552][ T5071] RAX: ffffffffffffffda RBX: 00007ffc9bed0330 RCX: 00007fdff6d3cf9a
[   73.591525][ T5071] RDX: 0000000020005100 RSI: 0000000020005140 RDI: 00007ffc9bed0330
[   73.599496][ T5071] RBP: 0000000000000004 R08: 00007ffc9bed0370 R09: 0000000000005103
[   73.607469][ T5071] R10: 0000000000000016 R11: 0000000000000282 R12: 0000000000000016
[   73.615437][ T5071] R13: 00007ffc9bed0370 R14: 0000000000000003 R15: 0000000001000000
[   73.623415][ T5071]  </TASK>
[   73.626429][ T5071] 
[   73.628744][ T5071] Allocated by task 5071:
[   73.633063][ T5071]  kasan_save_stack+0x33/0x50
[   73.637758][ T5071]  kasan_set_track+0x25/0x30
[   73.642356][ T5071]  __kasan_kmalloc+0xa2/0xb0
[   73.646956][ T5071]  alloc_fs_devices+0x54/0x2b0
[   73.651724][ T5071]  device_list_add.constprop.0+0x3eb/0x1db0
[   73.657626][ T5071]  btrfs_scan_one_device+0x1b7/0x2a0
[   73.662921][ T5071]  btrfs_mount_root+0x4a8/0xda0
[   73.667772][ T5071]  legacy_get_tree+0x109/0x220
[   73.672558][ T5071]  vfs_get_tree+0x88/0x350
[   73.676982][ T5071]  vfs_kern_mount.part.0+0xcb/0x170
[   73.682185][ T5071]  vfs_kern_mount+0x3f/0x60
[   73.686688][ T5071]  btrfs_mount+0x292/0xb10
[   73.691104][ T5071]  legacy_get_tree+0x109/0x220
[   73.695876][ T5071]  vfs_get_tree+0x88/0x350
[   73.700299][ T5071]  path_mount+0x1492/0x1ed0
[   73.704806][ T5071]  __x64_sys_mount+0x293/0x310
[   73.709575][ T5071]  do_syscall_64+0x38/0xb0
[   73.714003][ T5071]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   73.719908][ T5071] 
[   73.722222][ T5071] Freed by task 5070:
[   73.726189][ T5071]  kasan_save_stack+0x33/0x50
[   73.730874][ T5071]  kasan_set_track+0x25/0x30
[   73.735475][ T5071]  kasan_save_free_info+0x2b/0x40
[   73.740502][ T5071]  ____kasan_slab_free+0x15e/0x1b0
[   73.745624][ T5071]  slab_free_freelist_hook+0x114/0x1e0
[   73.751090][ T5071]  __kmem_cache_free+0xb8/0x2f0
[   73.755948][ T5071]  btrfs_close_devices+0x4cd/0x610
[   73.761063][ T5071]  open_ctree+0x1c1/0x5710
[   73.765480][ T5071]  btrfs_mount_root+0x976/0xda0
[   73.770332][ T5071]  legacy_get_tree+0x109/0x220
[   73.775106][ T5071]  vfs_get_tree+0x88/0x350
[   73.779527][ T5071]  vfs_kern_mount.part.0+0xcb/0x170
[   73.784728][ T5071]  vfs_kern_mount+0x3f/0x60
[   73.789235][ T5071]  btrfs_mount+0x292/0xb10
[   73.793653][ T5071]  legacy_get_tree+0x109/0x220
[   73.798424][ T5071]  vfs_get_tree+0x88/0x350
[   73.802846][ T5071]  path_mount+0x1492/0x1ed0
[   73.807358][ T5071]  __x64_sys_mount+0x293/0x310
[   73.812128][ T5071]  do_syscall_64+0x38/0xb0
[   73.816554][ T5071]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   73.822460][ T5071] 
[   73.824774][ T5071] The buggy address belongs to the object at ffff888021788000
[   73.824774][ T5071]  which belongs to the cache kmalloc-512 of size 512
[   73.838824][ T5071] The buggy address is located 304 bytes inside of
[   73.838824][ T5071]  freed 512-byte region [ffff888021788000, ffff888021788200)
[   73.852617][ T5071] 
[   73.854935][ T5071] The buggy address belongs to the physical page:
[   73.861335][ T5071] page:ffffea000085e200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21788
[   73.871482][ T5071] head:ffffea000085e200 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   73.880411][ T5071] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[   73.888386][ T5071] page_type: 0xffffffff()
[   73.892715][ T5071] raw: 00fff00000010200 ffff888012841c80 dead000000000100 dead000000000122
[   73.901297][ T5071] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[   73.909871][ T5071] page dumped because: kasan: bad access detected
[   73.916270][ T5071] page_owner tracks the page as allocated
[   73.921973][ T5071] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2005, tgid 2005 (kworker/u4:3), ts 14978345817, free_ts 0
[   73.942467][ T5071]  post_alloc_hook+0x2d2/0x350
[   73.947244][ T5071]  get_page_from_freelist+0x10d7/0x31b0
[   73.952802][ T5071]  __alloc_pages+0x1d0/0x4a0
[   73.957387][ T5071]  alloc_pages+0x1a9/0x270
[   73.961811][ T5071]  allocate_slab+0x24e/0x380
[   73.966406][ T5071]  ___slab_alloc+0x8bc/0x1570
[   73.971091][ T5071]  __slab_alloc.constprop.0+0x56/0xa0
[   73.976474][ T5071]  __kmem_cache_alloc_node+0x137/0x350
[   73.981947][ T5071]  kmalloc_trace+0x25/0xe0
[   73.986375][ T5071]  alloc_bprm+0x51/0xaf0
[   73.990617][ T5071]  kernel_execve+0xaf/0x4e0
[   73.995121][ T5071]  call_usermodehelper_exec_async+0x256/0x4c0
[   74.001189][ T5071]  ret_from_fork+0x45/0x80
[   74.005610][ T5071]  ret_from_fork_asm+0x11/0x20
[   74.010380][ T5071] page_owner free stack trace missing
[   74.015736][ T5071] 
[   74.018048][ T5071] Memory state around the buggy address:
[   74.023670][ T5071]  ffff888021788000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.031725][ T5071]  ffff888021788080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.039780][ T5071] >ffff888021788100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.047831][ T5071]                                      ^
[   74.053461][ T5071]  ffff888021788180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   74.061523][ T5071]  ffff888021788200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   74.069573][ T5071] ==================================================================
[pid  5075] ioctl(4, LOOP_CLR_FD <unfinished ...>
[pid  5072] <... ioctl resumed>)        = 0
[pid  5073] <... ioctl resumed>)        = 0
[pid  5073] close(4 <unfinished ...>
[   74.155631][ T5071] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   74.162849][ T5071] CPU: 1 PID: 5071 Comm: syz-executor375 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0
[   74.172755][ T5071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[   74.182819][ T5071] Call Trace:
[   74.186103][ T5071]  <TASK>
[   74.189042][ T5071]  dump_stack_lvl+0xd9/0x1b0
[   74.193671][ T5071]  panic+0x6a6/0x750
[   74.197588][ T5071]  ? panic_smp_self_stop+0xa0/0xa0
[   74.202720][ T5071]  ? trace_irq_enable.constprop.0+0xd0/0x100
[   74.208724][ T5071]  ? preempt_schedule_thunk+0x1a/0x30
[   74.214128][ T5071]  ? preempt_schedule_common+0x45/0xc0
[   74.219612][ T5071]  check_panic_on_warn+0xab/0xb0
[   74.224574][ T5071]  end_report+0x108/0x150
[   74.228937][ T5071]  kasan_report+0xea/0x110
[   74.233385][ T5071]  ? btrfs_open_devices+0xb8/0xc0
[   74.238466][ T5071]  ? btrfs_open_devices+0xb8/0xc0
[   74.243519][ T5071]  btrfs_open_devices+0xb8/0xc0
[   74.248395][ T5071]  btrfs_mount_root+0x681/0xda0
[   74.253268][ T5071]  ? btrfs_sync_fs+0x770/0x770
[   74.258053][ T5071]  ? legacy_parse_param+0x3d4/0x8e0
[   74.263282][ T5071]  ? bpf_lsm_fs_context_parse_param+0x9/0x10
[   74.269277][ T5071]  ? security_fs_context_parse_param+0xa7/0xd0
[   74.275457][ T5071]  ? generic_parse_monolithic+0x1f0/0x1f0
[   74.281215][ T5071]  ? vfs_parse_fs_string+0xfb/0x150
[   74.286445][ T5071]  ? vfs_parse_fs_param+0x3c0/0x3c0
[   74.291679][ T5071]  ? kasan_set_track+0x25/0x30
[   74.296485][ T5071]  ? btrfs_sync_fs+0x770/0x770
[   74.301268][ T5071]  legacy_get_tree+0x109/0x220
[   74.306065][ T5071]  vfs_get_tree+0x88/0x350
[   74.310506][ T5071]  vfs_kern_mount.part.0+0xcb/0x170
[   74.315727][ T5071]  vfs_kern_mount+0x3f/0x60
[   74.320262][ T5071]  btrfs_mount+0x292/0xb10
[   74.324704][ T5071]  ? btrfs_show_options+0x1230/0x1230
[   74.330100][ T5071]  ? vfs_parse_fs_param_source+0x103/0x1e0
[   74.335950][ T5071]  ? legacy_parse_param+0x3d4/0x8e0
[   74.341178][ T5071]  ? bpf_lsm_fs_context_parse_param+0x9/0x10
[   74.347176][ T5071]  ? security_fs_context_parse_param+0xa7/0xd0
[pid  5072] close(4 <unfinished ...>
[pid  5074] <... ioctl resumed>)        = 0
[pid  5074] close(4)                    = 0
[pid  5074] exit_group(0)               = ?
[pid  5074] +++ exited with 0 +++
[pid  5041] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5074, si_uid=0, si_status=0, si_utime=5 /* 0.05 s */, si_stime=33 /* 0.33 s */} ---
[   74.353353][ T5071]  ? generic_parse_monolithic+0x1f0/0x1f0
[   74.359119][ T5071]  ? vfs_parse_fs_string+0xfb/0x150
[   74.364348][ T5071]  ? apparmor_capable+0x1da/0x4e0
[   74.369397][ T5071]  ? btrfs_show_options+0x1230/0x1230
[   74.374789][ T5071]  legacy_get_tree+0x109/0x220
[   74.379581][ T5071]  vfs_get_tree+0x88/0x350
[   74.384020][ T5071]  path_mount+0x1492/0x1ed0
[   74.388548][ T5071]  ? kmem_cache_free+0xf0/0x490
[   74.393438][ T5071]  ? finish_automount+0xa50/0xa50
[   74.398495][ T5071]  ? putname+0x101/0x140
[pid  5041] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
[pid  5041] ioctl(3, LOOP_CLR_FD)       = -1 ENXIO (No such device or address)
[pid  5041] close(3)                    = 0
[pid  5041] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555555fe7650) = 5089
./strace-static-x86_64: Process 5089 attached
[pid  5089] set_robust_list(0x555555fe7660, 24) = 0
[pid  5089] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5089] setpgid(0, 0)               = 0
[pid  5089] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5089] write(3, "1000", 4)         = 4
[pid  5089] close(3)                    = 0
[pid  5089] memfd_create("syzkaller", 0) = 3
[pid  5089] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdfee8fd000
[   74.402762][ T5071]  __x64_sys_mount+0x293/0x310
[   74.407554][ T5071]  ? copy_mnt_ns+0xb60/0xb60
[   74.412172][ T5071]  ? _raw_spin_unlock_irq+0x2e/0x50
[   74.417404][ T5071]  ? ptrace_notify+0xf4/0x130
[   74.422105][ T5071]  do_syscall_64+0x38/0xb0
[   74.426555][ T5071]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   74.432494][ T5071] RIP: 0033:0x7fdff6d3cf9a
[   74.436928][ T5071] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   74.456556][ T5071] RSP: 002b:00007ffc9bed0318 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
[   74.464990][ T5071] RAX: ffffffffffffffda RBX: 00007ffc9bed0330 RCX: 00007fdff6d3cf9a
[   74.472978][ T5071] RDX: 0000000020005100 RSI: 0000000020005140 RDI: 00007ffc9bed0330
[   74.480960][ T5071] RBP: 0000000000000004 R08: 00007ffc9bed0370 R09: 0000000000005103
[   74.488948][ T5071] R10: 0000000000000016 R11: 0000000000000282 R12: 0000000000000016
[   74.496937][ T5071] R13: 00007ffc9bed0370 R14: 0000000000000003 R15: 0000000001000000
[   74.504937][ T5071]  </TASK>
[   74.508140][ T5071] Kernel Offset: disabled
[   74.512448][ T5071] Rebooting in 86400 seconds..