./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3171774632 <...> DUID 00:04:dd:0f:a4:e5:cb:b8:04:95:2f:30:92:03:b3:b6:0d:bc forked to background, child pid 4646 [ 29.986535][ T4647] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.998603][ T4647] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.218' (ECDSA) to the list of known hosts. execve("./syz-executor3171774632", ["./syz-executor3171774632"], 0x7ffe1b193460 /* 10 vars */) = 0 brk(NULL) = 0x555557148000 brk(0x555557148c40) = 0x555557148c40 arch_prctl(ARCH_SET_FS, 0x555557148300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 set_tid_address(0x5555571485d0) = 5067 set_robust_list(0x5555571485e0, 24) = 0 rt_sigaction(SIGRTMIN, {sa_handler=0x7f273fc33660, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f273fc33d30}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=0x7f273fc33700, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f273fc33d30}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3171774632", 4096) = 28 brk(0x555557169c40) = 0x555557169c40 brk(0x55555716a000) = 0x55555716a000 mprotect(0x7f273fcfb000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 getpid() = 5067 mkdir("./syzkaller.FuFiwl", 0700) = 0 chmod("./syzkaller.FuFiwl", 0777) = 0 chdir("./syzkaller.FuFiwl") = 0 mkdir("./0", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5068 ./strace-static-x86_64: Process 5068 attached [pid 5068] set_robust_list(0x5555571485e0, 24) = 0 [pid 5068] chdir("./0") = 0 [pid 5068] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5068] setpgid(0, 0) = 0 [pid 5068] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "1000", 4) = 4 [pid 5068] close(3) = 0 [pid 5068] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5068] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5068] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5068] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5068] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5070], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5070 [pid 5068] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5068] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5070 attached [pid 5070] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5070] memfd_create("syzkaller", 0) = 3 [pid 5070] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5070] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5070] munmap(0x7f2737802000, 16777216) = 0 [pid 5070] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5070] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5070] close(3) = 0 [pid 5070] mkdir("./file0", 0777) = 0 [pid 5070] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5070] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5070] chdir("./file0") = 0 [pid 5070] ioctl(4, LOOP_CLR_FD) = 0 [pid 5070] close(4) = 0 [pid 5070] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5068] <... futex resumed>) = 0 [pid 5070] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5068] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5070] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5068] <... futex resumed>) = 0 [pid 5070] mkdir(".", 0777 [pid 5068] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5070] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5068] <... futex resumed>) = 0 [pid 5070] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "" [pid 5068] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5068] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5068] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5071], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5071 [pid 5068] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5071 attached ) = 0 [pid 5068] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5071] set_robust_list(0x7f27388019e0, 24) = 0 [pid 5071] open("./file0", O_RDONLY [pid 5070] <... mount resumed>) = 0 [pid 5071] <... open resumed>) = 4 [pid 5071] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5068] <... futex resumed>) = 0 [pid 5071] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5068] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5071] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5068] <... futex resumed>) = 0 [pid 5068] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5071] getdents(4, [pid 5070] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY [pid 5071] <... getdents resumed>0x20000100 /* 2 entries */, 76) = 48 [pid 5071] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5070] <... openat resumed>) = 5 [pid 5068] <... futex resumed>) = 0 [pid 5071] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5070] chdir(".") = 0 [pid 5070] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5070] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5068] exit_group(0 [pid 5071] <... futex resumed>) = ? [pid 5070] <... futex resumed>) = ? [pid 5068] <... exit_group resumed>) = ? [pid 5071] +++ exited with 0 +++ [pid 5070] +++ exited with 0 +++ [pid 5068] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5068, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=16 /* 0.16 s */} --- syzkaller login: [ 52.826430][ T5070] loop0: detected capacity change from 0 to 32768 umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./0/binderfs") = 0 umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./0/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./0/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./0") = 0 mkdir("./1", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5072 attached , child_tidptr=0x5555571485d0) = 5072 [pid 5072] set_robust_list(0x5555571485e0, 24) = 0 [pid 5072] chdir("./1") = 0 [pid 5072] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5072] setpgid(0, 0) = 0 [pid 5072] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5072] write(3, "1000", 4) = 4 [pid 5072] close(3) = 0 [pid 5072] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5072] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5072] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5072] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5072] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5073 attached , parent_tid=[5073], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5073 [pid 5073] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5073] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5072] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5072] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5073] <... futex resumed>) = 0 [pid 5073] memfd_create("syzkaller", 0) = 3 [pid 5073] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5073] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5073] munmap(0x7f2737802000, 16777216) = 0 [pid 5073] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5073] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5073] close(3) = 0 [pid 5073] mkdir("./file0", 0777) = 0 [pid 5073] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5073] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5073] chdir("./file0") = 0 [pid 5073] ioctl(4, LOOP_CLR_FD) = 0 [pid 5073] close(4) = 0 [pid 5073] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5072] <... futex resumed>) = 0 [pid 5072] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5072] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5072] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5073] mkdir(".", 0777 [pid 5072] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE [pid 5073] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5072] <... mprotect resumed>) = 0 [pid 5073] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "" [pid 5072] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5074], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5074 [pid 5072] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5072] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5074 attached [pid 5074] set_robust_list(0x7f27388019e0, 24) = 0 [pid 5074] open("./file0", O_RDONLY) = 4 [pid 5074] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5073] <... mount resumed>) = 0 [pid 5072] <... futex resumed>) = 0 [pid 5072] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5072] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5074] getdents(4, [pid 5073] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY [pid 5074] <... getdents resumed>0x20000100 /* 2 entries */, 76) = 48 [pid 5073] <... openat resumed>) = 5 [pid 5073] chdir(".") = 0 [pid 5073] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5073] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5074] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5072] <... futex resumed>) = 0 [pid 5074] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5072] exit_group(0 [pid 5074] <... futex resumed>) = ? [pid 5073] <... futex resumed>) = ? [pid 5072] <... exit_group resumed>) = ? [pid 5073] +++ exited with 0 +++ [pid 5074] +++ exited with 0 +++ [pid 5072] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5072, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=12 /* 0.12 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./1/binderfs") = 0 [ 53.113384][ T5073] loop0: detected capacity change from 0 to 32768 umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./1/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./1/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./1") = 0 mkdir("./2", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5075 ./strace-static-x86_64: Process 5075 attached [pid 5075] set_robust_list(0x5555571485e0, 24) = 0 [pid 5075] chdir("./2") = 0 [pid 5075] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5075] setpgid(0, 0) = 0 [pid 5075] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5075] write(3, "1000", 4) = 4 [pid 5075] close(3) = 0 [pid 5075] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5075] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5075] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5075] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5075] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5076], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5076 [pid 5075] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5075] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5076 attached [pid 5076] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5076] memfd_create("syzkaller", 0) = 3 [pid 5076] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5076] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5076] munmap(0x7f2737802000, 16777216) = 0 [pid 5076] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5076] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5076] close(3) = 0 [pid 5076] mkdir("./file0", 0777) = 0 [pid 5076] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5076] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5076] chdir("./file0") = 0 [pid 5076] ioctl(4, LOOP_CLR_FD) = 0 [pid 5076] close(4) = 0 [pid 5076] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... futex resumed>) = 0 [pid 5075] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5075] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5075] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5075] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5075] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5077], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5077 [pid 5075] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5075] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... futex resumed>) = 1 [pid 5076] mkdir(".", 0777) = -1 EEXIST (File exists) [pid 5076] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "") = 0 [pid 5076] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 4 [pid 5076] chdir(".") = 0 [pid 5076] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5076] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 5077 attached [pid 5077] set_robust_list(0x7f27388019e0, 24) = 0 [pid 5077] open("./file0", O_RDONLY) = 5 [pid 5077] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... futex resumed>) = 0 [pid 5075] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5075] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5076] <... futex resumed>) = 0 [pid 5077] <... futex resumed>) = 1 [pid 5076] getdents(5, [pid 5077] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5076] <... getdents resumed>0x20000100 /* 2 entries */, 76) = 48 [pid 5076] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5075] <... futex resumed>) = 0 [pid 5075] exit_group(0) = ? [pid 5076] <... futex resumed>) = ? [pid 5076] +++ exited with 0 +++ [pid 5077] <... futex resumed>) = ? [pid 5077] +++ exited with 0 +++ [pid 5075] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5075, si_uid=0, si_status=0, si_utime=0, si_stime=14 /* 0.14 s */} --- umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./2/binderfs") = 0 umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./2/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./2/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./2") = 0 mkdir("./3", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [ 53.379138][ T5076] loop0: detected capacity change from 0 to 32768 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5078 ./strace-static-x86_64: Process 5078 attached [pid 5078] set_robust_list(0x5555571485e0, 24) = 0 [pid 5078] chdir("./3") = 0 [pid 5078] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5078] setpgid(0, 0) = 0 [pid 5078] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5078] write(3, "1000", 4) = 4 [pid 5078] close(3) = 0 [pid 5078] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5078] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5078] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5078] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5078] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5079], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5079 [pid 5078] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5078] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5079 attached [pid 5079] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5079] memfd_create("syzkaller", 0) = 3 [pid 5079] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5079] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5079] munmap(0x7f2737802000, 16777216) = 0 [pid 5079] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5079] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5079] close(3) = 0 [pid 5079] mkdir("./file0", 0777) = 0 [pid 5079] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5079] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5079] chdir("./file0") = 0 [pid 5079] ioctl(4, LOOP_CLR_FD) = 0 [pid 5079] close(4) = 0 [pid 5079] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5078] <... futex resumed>) = 0 [pid 5078] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5078] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5078] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5078] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5078] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5080], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5080 [pid 5078] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5078] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5079] <... futex resumed>) = 1 [pid 5079] mkdir(".", 0777) = -1 EEXIST (File exists) [pid 5079] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "") = 0 ./strace-static-x86_64: Process 5080 attached [pid 5079] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY [pid 5080] set_robust_list(0x7f27388019e0, 24) = 0 [pid 5079] <... openat resumed>) = 4 [pid 5079] chdir(".") = 0 [pid 5079] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5079] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5080] open("./file0", O_RDONLY) = 5 [pid 5080] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5080] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5078] <... futex resumed>) = 0 [pid 5078] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5078] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5079] <... futex resumed>) = 0 [pid 5079] getdents(5, 0x20000100 /* 2 entries */, 76) = 48 [pid 5079] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5078] <... futex resumed>) = 0 [pid 5078] exit_group(0) = ? [pid 5079] +++ exited with 0 +++ [pid 5080] <... futex resumed>) = ? [pid 5080] +++ exited with 0 +++ [pid 5078] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5078, si_uid=0, si_status=0, si_utime=4 /* 0.04 s */, si_stime=13 /* 0.13 s */} --- umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./3/binderfs") = 0 umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./3/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./3/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./3") = 0 mkdir("./4", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5081 ./strace-static-x86_64: Process 5081 attached [pid 5081] set_robust_list(0x5555571485e0, 24) = 0 [pid 5081] chdir("./4") = 0 [pid 5081] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5081] setpgid(0, 0) = 0 [pid 5081] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5081] write(3, "1000", 4) = 4 [pid 5081] close(3) = 0 [pid 5081] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5081] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5081] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5081] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5081] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5082], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5082 [pid 5081] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5081] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5082 attached [pid 5082] set_robust_list(0x7f273fc229e0, 24) = 0 [ 53.643244][ T5079] loop0: detected capacity change from 0 to 32768 [pid 5082] memfd_create("syzkaller", 0) = 3 [pid 5082] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5082] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5082] munmap(0x7f2737802000, 16777216) = 0 [pid 5082] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5082] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5082] close(3) = 0 [pid 5082] mkdir("./file0", 0777) = 0 [pid 5082] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5082] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5082] chdir("./file0") = 0 [pid 5082] ioctl(4, LOOP_CLR_FD) = 0 [pid 5082] close(4) = 0 [pid 5082] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5081] <... futex resumed>) = 0 [pid 5081] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5081] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5081] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5081] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5081] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5083], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5083 [pid 5081] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5081] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5082] <... futex resumed>) = 1 [pid 5082] mkdir(".", 0777) = -1 EEXIST (File exists) [pid 5082] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, ""./strace-static-x86_64: Process 5083 attached [pid 5083] set_robust_list(0x7f27388019e0, 24) = 0 [pid 5083] open("./file0", O_RDONLY [pid 5082] <... mount resumed>) = 0 [pid 5082] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 4 [pid 5082] chdir(".") = 0 [pid 5082] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5082] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5083] <... open resumed>) = 5 [pid 5083] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5081] <... futex resumed>) = 0 [pid 5081] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5081] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5083] <... futex resumed>) = 1 [pid 5083] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5082] <... futex resumed>) = 0 [pid 5082] getdents(5, 0x20000100 /* 2 entries */, 76) = 48 [pid 5082] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5081] <... futex resumed>) = 0 [pid 5081] exit_group(0) = ? [pid 5083] <... futex resumed>) = ? [pid 5083] +++ exited with 0 +++ [pid 5082] <... futex resumed>) = ? [pid 5082] +++ exited with 0 +++ [pid 5081] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5081, si_uid=0, si_status=0, si_utime=0, si_stime=15 /* 0.15 s */} --- umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./4/binderfs") = 0 [ 53.882218][ T5082] loop0: detected capacity change from 0 to 32768 umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./4/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./4/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./4/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./4") = 0 mkdir("./5", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5084 ./strace-static-x86_64: Process 5084 attached [pid 5084] set_robust_list(0x5555571485e0, 24) = 0 [pid 5084] chdir("./5") = 0 [pid 5084] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5084] setpgid(0, 0) = 0 [pid 5084] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5084] write(3, "1000", 4) = 4 [pid 5084] close(3) = 0 [pid 5084] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5084] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5084] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5084] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5084] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5085 attached , parent_tid=[5085], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5085 [pid 5084] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5084] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5085] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5085] memfd_create("syzkaller", 0) = 3 [pid 5085] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5085] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5085] munmap(0x7f2737802000, 16777216) = 0 [pid 5085] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5085] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5085] close(3) = 0 [pid 5085] mkdir("./file0", 0777) = 0 [pid 5085] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5085] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5085] chdir("./file0") = 0 [pid 5085] ioctl(4, LOOP_CLR_FD) = 0 [pid 5085] close(4) = 0 [pid 5085] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5084] <... futex resumed>) = 0 [pid 5085] mkdir(".", 0777 [pid 5084] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5085] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5084] <... futex resumed>) = 0 [pid 5085] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "" [pid 5084] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5084] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5084] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5084] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5086 attached [pid 5086] set_robust_list(0x7f27388019e0, 24 [pid 5084] <... clone resumed>, parent_tid=[5086], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5086 [pid 5086] <... set_robust_list resumed>) = 0 [pid 5084] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5086] open("./file0", O_RDONLY [pid 5085] <... mount resumed>) = 0 [pid 5084] <... futex resumed>) = 0 [pid 5086] <... open resumed>) = 4 [pid 5084] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5086] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5085] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY [pid 5084] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5086] <... futex resumed>) = 0 [pid 5085] <... openat resumed>) = 5 [pid 5084] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5086] getdents(4, [pid 5085] chdir("." [pid 5084] <... futex resumed>) = 0 [pid 5086] <... getdents resumed>0x20000100 /* 2 entries */, 76) = 48 [pid 5085] <... chdir resumed>) = 0 [pid 5084] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5086] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5085] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5084] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5086] <... futex resumed>) = 0 [pid 5086] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5084] exit_group(0 [pid 5085] <... futex resumed>) = ? [pid 5084] <... exit_group resumed>) = ? [pid 5086] <... futex resumed>) = ? [pid 5086] +++ exited with 0 +++ [pid 5085] +++ exited with 0 +++ [pid 5084] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5084, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=11 /* 0.11 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./5/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./5/binderfs") = 0 [ 54.156758][ T5085] loop0: detected capacity change from 0 to 32768 umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./5/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./5/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./5/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./5") = 0 mkdir("./6", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5087 ./strace-static-x86_64: Process 5087 attached [pid 5087] set_robust_list(0x5555571485e0, 24) = 0 [pid 5087] chdir("./6") = 0 [pid 5087] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5087] setpgid(0, 0) = 0 [pid 5087] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5087] write(3, "1000", 4) = 4 [pid 5087] close(3) = 0 [pid 5087] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5087] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5087] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5087] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5087] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5088 attached , parent_tid=[5088], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5088 [pid 5087] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5087] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5088] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5088] memfd_create("syzkaller", 0) = 3 [pid 5088] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5088] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5088] munmap(0x7f2737802000, 16777216) = 0 [pid 5088] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5088] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5088] close(3) = 0 [pid 5088] mkdir("./file0", 0777) = 0 [pid 5088] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5088] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5088] chdir("./file0") = 0 [pid 5088] ioctl(4, LOOP_CLR_FD) = 0 [pid 5088] close(4) = 0 [pid 5088] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5088] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5087] <... futex resumed>) = 0 [pid 5087] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5088] <... futex resumed>) = 0 [pid 5088] mkdir(".", 0777) = -1 EEXIST (File exists) [pid 5088] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "" [pid 5087] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5087] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5087] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5087] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5089], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5089 [pid 5087] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5087] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5089 attached [pid 5089] set_robust_list(0x7f27388019e0, 24) = 0 [pid 5089] open("./file0", O_RDONLY) = 4 [pid 5089] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5087] <... futex resumed>) = 0 [pid 5087] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5087] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5088] <... mount resumed>) = 0 [pid 5088] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 5 [pid 5088] chdir(".") = 0 [pid 5088] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5088] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5089] getdents(4, 0x20000100 /* 2 entries */, 76) = 48 [pid 5089] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5087] <... futex resumed>) = 0 [pid 5087] exit_group(0) = ? [pid 5088] <... futex resumed>) = ? [pid 5088] +++ exited with 0 +++ [pid 5089] <... futex resumed>) = ? [pid 5089] +++ exited with 0 +++ [pid 5087] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5087, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=13 /* 0.13 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./6/binderfs") = 0 umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./6/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./6/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./6/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./6") = 0 mkdir("./7", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5090 ./strace-static-x86_64: Process 5090 attached [pid 5090] set_robust_list(0x5555571485e0, 24) = 0 [pid 5090] chdir("./7") = 0 [pid 5090] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5090] setpgid(0, 0) = 0 [ 54.428230][ T5088] loop0: detected capacity change from 0 to 32768 [pid 5090] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5090] write(3, "1000", 4) = 4 [pid 5090] close(3) = 0 [pid 5090] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5090] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5090] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5090] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5090] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5091], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5091 [pid 5090] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5090] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5091 attached [pid 5091] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5091] memfd_create("syzkaller", 0) = 3 [pid 5091] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5091] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5091] munmap(0x7f2737802000, 16777216) = 0 [pid 5091] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5091] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5091] close(3) = 0 [pid 5091] mkdir("./file0", 0777) = 0 [pid 5091] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5091] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5091] chdir("./file0") = 0 [pid 5091] ioctl(4, LOOP_CLR_FD) = 0 [pid 5091] close(4) = 0 [pid 5091] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5090] <... futex resumed>) = 0 [pid 5091] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5090] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5091] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5090] <... futex resumed>) = 0 [pid 5091] mkdir(".", 0777 [pid 5090] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5091] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5090] <... futex resumed>) = 0 [pid 5091] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "" [pid 5090] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5090] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5090] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5092], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5092 [pid 5090] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5090] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5092 attached [pid 5091] <... mount resumed>) = 0 [pid 5091] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 4 [pid 5091] chdir("." [pid 5092] set_robust_list(0x7f27388019e0, 24 [pid 5091] <... chdir resumed>) = 0 [pid 5092] <... set_robust_list resumed>) = 0 [pid 5091] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5092] open("./file0", O_RDONLY [pid 5091] <... futex resumed>) = 0 [pid 5091] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5092] <... open resumed>) = 5 [pid 5092] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5090] <... futex resumed>) = 0 [pid 5090] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5091] <... futex resumed>) = 0 [pid 5090] <... futex resumed>) = 1 [pid 5091] getdents(5, [pid 5090] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5091] <... getdents resumed>0x20000100 /* 2 entries */, 76) = 48 [pid 5091] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5090] <... futex resumed>) = 0 [pid 5091] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5090] exit_group(0 [pid 5091] <... futex resumed>) = ? [pid 5090] <... exit_group resumed>) = ? [pid 5091] +++ exited with 0 +++ [pid 5092] +++ exited with 0 +++ [pid 5090] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5090, si_uid=0, si_status=0, si_utime=0, si_stime=15 /* 0.15 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./7/binderfs") = 0 umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./7/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./7/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./7/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./7/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./7") = 0 mkdir("./8", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5093 [ 54.679409][ T5091] loop0: detected capacity change from 0 to 32768 ./strace-static-x86_64: Process 5093 attached [pid 5093] set_robust_list(0x5555571485e0, 24) = 0 [pid 5093] chdir("./8") = 0 [pid 5093] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5093] setpgid(0, 0) = 0 [pid 5093] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5093] write(3, "1000", 4) = 4 [pid 5093] close(3) = 0 [pid 5093] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5093] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5093] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5093] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5093] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5094], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5094 [pid 5093] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5093] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5094 attached [pid 5094] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5094] memfd_create("syzkaller", 0) = 3 [pid 5094] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5094] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5094] munmap(0x7f2737802000, 16777216) = 0 [pid 5094] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5094] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5094] close(3) = 0 [pid 5094] mkdir("./file0", 0777) = 0 [pid 5094] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5094] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5094] chdir("./file0") = 0 [pid 5094] ioctl(4, LOOP_CLR_FD) = 0 [pid 5094] close(4) = 0 [pid 5094] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5093] <... futex resumed>) = 0 [pid 5094] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5093] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5094] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5093] <... futex resumed>) = 0 [pid 5094] mkdir(".", 0777 [pid 5093] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5094] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5093] <... futex resumed>) = 0 [pid 5094] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "" [pid 5093] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5093] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5093] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5095], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5095 [pid 5093] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5093] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5095 attached [pid 5095] set_robust_list(0x7f27388019e0, 24 [pid 5094] <... mount resumed>) = 0 [pid 5094] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 4 [pid 5094] chdir(".") = 0 [pid 5094] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5094] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5095] <... set_robust_list resumed>) = 0 [pid 5095] open("./file0", O_RDONLY) = 5 [pid 5095] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5093] <... futex resumed>) = 0 [pid 5095] <... futex resumed>) = 1 [pid 5093] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5095] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5094] <... futex resumed>) = 0 [pid 5093] <... futex resumed>) = 1 [pid 5094] getdents(5, 0x20000100 /* 2 entries */, 76) = 48 [pid 5093] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5094] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5093] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5094] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5093] exit_group(0 [pid 5094] <... futex resumed>) = ? [pid 5095] <... futex resumed>) = ? [pid 5093] <... exit_group resumed>) = ? [pid 5095] +++ exited with 0 +++ [pid 5094] +++ exited with 0 +++ [pid 5093] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5093, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=10 /* 0.10 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./8/binderfs") = 0 [ 54.939520][ T5094] loop0: detected capacity change from 0 to 32768 umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./8/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./8/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./8") = 0 mkdir("./9", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5096 ./strace-static-x86_64: Process 5096 attached [pid 5096] set_robust_list(0x5555571485e0, 24) = 0 [pid 5096] chdir("./9") = 0 [pid 5096] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5096] setpgid(0, 0) = 0 [pid 5096] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5096] write(3, "1000", 4) = 4 [pid 5096] close(3) = 0 [pid 5096] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5096] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5096] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5096] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5096] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5097 attached , parent_tid=[5097], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5097 [pid 5096] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5096] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5097] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5097] memfd_create("syzkaller", 0) = 3 [pid 5097] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5097] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5097] munmap(0x7f2737802000, 16777216) = 0 [pid 5097] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5097] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5097] close(3) = 0 [pid 5097] mkdir("./file0", 0777) = 0 [pid 5097] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5097] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5097] chdir("./file0") = 0 [pid 5097] ioctl(4, LOOP_CLR_FD) = 0 [pid 5097] close(4) = 0 [pid 5097] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5096] <... futex resumed>) = 0 [pid 5097] <... futex resumed>) = 1 [pid 5096] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5097] mkdir(".", 0777 [pid 5096] <... futex resumed>) = 0 [pid 5097] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5096] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5097] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "" [pid 5096] <... futex resumed>) = 0 [pid 5096] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5096] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5096] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5098], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5098 [pid 5096] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5096] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5097] <... mount resumed>) = 0 [pid 5097] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 4 [pid 5097] chdir(".") = 0 [pid 5097] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5097] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 5098 attached [pid 5098] set_robust_list(0x7f27388019e0, 24) = 0 [pid 5098] open("./file0", O_RDONLY) = 5 [pid 5098] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5096] <... futex resumed>) = 0 [pid 5096] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5097] <... futex resumed>) = 0 [pid 5096] <... futex resumed>) = 1 [pid 5097] getdents(5, [pid 5096] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5097] <... getdents resumed>0x20000100 /* 2 entries */, 76) = 48 [pid 5097] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5096] <... futex resumed>) = 0 [pid 5097] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5096] exit_group(0 [pid 5097] <... futex resumed>) = ? [pid 5096] <... exit_group resumed>) = ? [pid 5097] +++ exited with 0 +++ [pid 5098] <... futex resumed>) = ? [pid 5098] +++ exited with 0 +++ [pid 5096] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5096, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=12 /* 0.12 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./9/binderfs") = 0 umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./9/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./9/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./9") = 0 mkdir("./10", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [ 55.203836][ T5097] loop0: detected capacity change from 0 to 32768 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5099 ./strace-static-x86_64: Process 5099 attached [pid 5099] set_robust_list(0x5555571485e0, 24) = 0 [pid 5099] chdir("./10") = 0 [pid 5099] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5099] setpgid(0, 0) = 0 [pid 5099] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5099] write(3, "1000", 4) = 4 [pid 5099] close(3) = 0 [pid 5099] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5099] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5099] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5099] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5099] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5100], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5100 [pid 5099] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5099] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5100 attached [pid 5100] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5100] memfd_create("syzkaller", 0) = 3 [pid 5100] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5100] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5100] munmap(0x7f2737802000, 16777216) = 0 [pid 5100] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5100] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5100] close(3) = 0 [pid 5100] mkdir("./file0", 0777) = 0 [pid 5100] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5100] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5100] chdir("./file0") = 0 [pid 5100] ioctl(4, LOOP_CLR_FD) = 0 [pid 5100] close(4) = 0 [pid 5100] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5100] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5099] <... futex resumed>) = 0 [pid 5099] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5099] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5100] <... futex resumed>) = 0 [pid 5099] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5100] mkdir(".", 0777 [pid 5099] <... mmap resumed>) = 0x7f27387e1000 [pid 5100] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5099] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE [pid 5100] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "" [pid 5099] <... mprotect resumed>) = 0 [pid 5099] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5101], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5101 [pid 5099] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5099] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5101 attached [pid 5101] set_robust_list(0x7f27388019e0, 24 [pid 5100] <... mount resumed>) = 0 [pid 5101] <... set_robust_list resumed>) = 0 [pid 5100] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 4 [pid 5100] chdir(".") = 0 [pid 5100] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5100] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5101] open("./file0", O_RDONLY) = 5 [pid 5101] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5099] <... futex resumed>) = 0 [pid 5101] <... futex resumed>) = 1 [pid 5099] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5101] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5100] <... futex resumed>) = 0 [pid 5099] <... futex resumed>) = 1 [pid 5100] getdents(5, [pid 5099] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5100] <... getdents resumed>0x20000100 /* 2 entries */, 76) = 48 [pid 5100] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5099] <... futex resumed>) = 0 [pid 5099] exit_group(0 [pid 5101] <... futex resumed>) = ? [pid 5099] <... exit_group resumed>) = ? [pid 5101] +++ exited with 0 +++ [pid 5100] +++ exited with 0 +++ [pid 5099] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5099, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=10 /* 0.10 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./10/binderfs") = 0 umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./10/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./10/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./10") = 0 mkdir("./11", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5102 [ 55.458725][ T5100] loop0: detected capacity change from 0 to 32768 ./strace-static-x86_64: Process 5102 attached [pid 5102] set_robust_list(0x5555571485e0, 24) = 0 [pid 5102] chdir("./11") = 0 [pid 5102] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5102] setpgid(0, 0) = 0 [pid 5102] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5102] write(3, "1000", 4) = 4 [pid 5102] close(3) = 0 [pid 5102] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5102] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5102] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5102] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5102] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5103], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5103 [pid 5102] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5102] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5103 attached [pid 5103] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5103] memfd_create("syzkaller", 0) = 3 [pid 5103] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5103] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5103] munmap(0x7f2737802000, 16777216) = 0 [pid 5103] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5103] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5103] close(3) = 0 [pid 5103] mkdir("./file0", 0777) = 0 [pid 5103] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5103] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5103] chdir("./file0") = 0 [pid 5103] ioctl(4, LOOP_CLR_FD) = 0 [pid 5103] close(4) = 0 [pid 5103] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5102] <... futex resumed>) = 0 [pid 5102] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5102] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5102] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5102] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5102] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5104], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5104 [pid 5102] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5103] <... futex resumed>) = 1 [pid 5102] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5103] mkdir(".", 0777) = -1 EEXIST (File exists) [pid 5103] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, ""./strace-static-x86_64: Process 5104 attached [pid 5104] set_robust_list(0x7f27388019e0, 24) = 0 [pid 5104] open("./file0", O_RDONLY [pid 5103] <... mount resumed>) = 0 [pid 5103] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY [pid 5104] <... open resumed>) = 4 [pid 5103] <... openat resumed>) = 5 [pid 5103] chdir(".") = 0 [pid 5103] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5104] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5103] <... futex resumed>) = 0 [pid 5104] <... futex resumed>) = 1 [pid 5103] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5102] <... futex resumed>) = 0 [pid 5103] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5102] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5103] getdents(4, [pid 5102] <... futex resumed>) = 0 [pid 5103] <... getdents resumed>0x20000100 /* 2 entries */, 76) = 48 [pid 5102] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5103] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5102] <... futex resumed>) = 0 [pid 5103] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5102] exit_group(0 [pid 5103] <... futex resumed>) = ? [pid 5102] <... exit_group resumed>) = ? [pid 5103] +++ exited with 0 +++ [pid 5104] +++ exited with 0 +++ [pid 5102] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5102, si_uid=0, si_status=0, si_utime=0, si_stime=12 /* 0.12 s */} --- umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./11/binderfs") = 0 umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./11/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./11/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./11") = 0 mkdir("./12", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = 0 close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5105 ./strace-static-x86_64: Process 5105 attached [pid 5105] set_robust_list(0x5555571485e0, 24) = 0 [pid 5105] chdir("./12") = 0 [pid 5105] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5105] setpgid(0, 0) = 0 [pid 5105] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5105] write(3, "1000", 4) = 4 [pid 5105] close(3) = 0 [pid 5105] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5105] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5105] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5105] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5105] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5106], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5106 [pid 5105] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5105] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5106 attached [pid 5106] set_robust_list(0x7f273fc229e0, 24) = 0 [ 55.717822][ T5103] loop0: detected capacity change from 0 to 32768 [pid 5106] memfd_create("syzkaller", 0) = 3 [pid 5106] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5106] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5106] munmap(0x7f2737802000, 16777216) = 0 [pid 5106] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5106] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5106] close(3) = 0 [pid 5106] mkdir("./file0", 0777) = 0 [pid 5106] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5106] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5106] chdir("./file0") = 0 [pid 5106] ioctl(4, LOOP_CLR_FD) = 0 [pid 5106] close(4) = 0 [pid 5106] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5105] <... futex resumed>) = 0 [pid 5106] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5105] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5106] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5105] <... futex resumed>) = 0 [pid 5106] mkdir(".", 0777 [pid 5105] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5106] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5105] <... futex resumed>) = 0 [pid 5106] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "" [pid 5105] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5105] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5106] <... mount resumed>) = 0 [pid 5105] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5107 attached [pid 5107] set_robust_list(0x7f27388019e0, 24 [pid 5105] <... clone resumed>, parent_tid=[5107], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5107 [pid 5107] <... set_robust_list resumed>) = 0 [pid 5105] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5107] open("./file0", O_RDONLY [pid 5105] <... futex resumed>) = 0 [pid 5105] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5107] <... open resumed>) = 4 [pid 5107] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5105] <... futex resumed>) = 0 [pid 5107] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5105] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5107] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5105] <... futex resumed>) = 0 [pid 5107] getdents(4, [pid 5105] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5107] <... getdents resumed>0x20000100 /* 2 entries */, 76) = 48 [pid 5107] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5106] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY [pid 5107] <... futex resumed>) = 1 [pid 5105] <... futex resumed>) = 0 [pid 5106] <... openat resumed>) = 5 [pid 5107] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5106] chdir(".") = 0 [pid 5106] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5106] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5105] exit_group(0 [pid 5107] <... futex resumed>) = ? [pid 5106] <... futex resumed>) = ? [pid 5105] <... exit_group resumed>) = ? [pid 5107] +++ exited with 0 +++ [pid 5106] +++ exited with 0 +++ [pid 5105] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5105, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=14 /* 0.14 s */} --- umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./12/binderfs") = 0 [ 55.956004][ T5106] loop0: detected capacity change from 0 to 32768 umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./12/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./12/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./12") = 0 mkdir("./13", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5108 ./strace-static-x86_64: Process 5108 attached [pid 5108] set_robust_list(0x5555571485e0, 24) = 0 [pid 5108] chdir("./13") = 0 [pid 5108] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5108] setpgid(0, 0) = 0 [pid 5108] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5108] write(3, "1000", 4) = 4 [pid 5108] close(3) = 0 [pid 5108] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5108] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5108] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5108] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5108] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5109], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5109 ./strace-static-x86_64: Process 5109 attached [pid 5108] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5108] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5109] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5109] memfd_create("syzkaller", 0) = 3 [pid 5109] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5109] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5109] munmap(0x7f2737802000, 16777216) = 0 [pid 5109] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5109] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5109] close(3) = 0 [pid 5109] mkdir("./file0", 0777) = 0 [pid 5109] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5109] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5109] chdir("./file0") = 0 [pid 5109] ioctl(4, LOOP_CLR_FD) = 0 [pid 5109] close(4) = 0 [pid 5109] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5108] <... futex resumed>) = 0 [pid 5108] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5108] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5108] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5109] <... futex resumed>) = 1 [pid 5108] <... mmap resumed>) = 0x7f27387e1000 [pid 5109] mkdir(".", 0777) = -1 EEXIST (File exists) [pid 5109] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "" [pid 5108] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5108] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5110], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5110 [pid 5108] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5108] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5110 attached [pid 5110] set_robust_list(0x7f27388019e0, 24) = 0 [pid 5110] open("./file0", O_RDONLY [pid 5109] <... mount resumed>) = 0 [pid 5109] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 5 [pid 5109] chdir(".") = 0 [pid 5109] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5109] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5110] <... open resumed>) = 4 [pid 5110] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5108] <... futex resumed>) = 0 [pid 5108] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5109] <... futex resumed>) = 0 [pid 5108] <... futex resumed>) = 1 [pid 5109] getdents(4, [pid 5108] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5109] <... getdents resumed>0x20000100 /* 2 entries */, 76) = 48 [pid 5109] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5108] <... futex resumed>) = 0 [ 56.249999][ T5109] loop0: detected capacity change from 0 to 32768 [pid 5109] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5110] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5108] exit_group(0) = ? [pid 5110] <... futex resumed>) = ? [pid 5109] <... futex resumed>) = ? [pid 5110] +++ exited with 0 +++ [pid 5109] +++ exited with 0 +++ [pid 5108] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5108, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=15 /* 0.15 s */} --- umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./13/binderfs") = 0 umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./13/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./13/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./13") = 0 mkdir("./14", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5111 ./strace-static-x86_64: Process 5111 attached [pid 5111] set_robust_list(0x5555571485e0, 24) = 0 [pid 5111] chdir("./14") = 0 [pid 5111] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5111] setpgid(0, 0) = 0 [pid 5111] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5111] write(3, "1000", 4) = 4 [pid 5111] close(3) = 0 [pid 5111] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5111] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5111] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5111] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5111] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5112 attached , parent_tid=[5112], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5112 [pid 5111] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5111] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5112] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5112] memfd_create("syzkaller", 0) = 3 [pid 5112] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5112] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5112] munmap(0x7f2737802000, 16777216) = 0 [pid 5112] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5112] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5112] close(3) = 0 [pid 5112] mkdir("./file0", 0777) = 0 [pid 5112] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5112] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5112] chdir("./file0") = 0 [pid 5112] ioctl(4, LOOP_CLR_FD) = 0 [pid 5112] close(4) = 0 [pid 5112] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5111] <... futex resumed>) = 0 [pid 5112] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5111] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5112] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5111] <... futex resumed>) = 0 [pid 5111] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5112] mkdir(".", 0777 [pid 5111] <... futex resumed>) = 0 [pid 5112] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 5111] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5112] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "" [pid 5111] <... mmap resumed>) = 0x7f27387e1000 [pid 5111] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5111] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5113], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5113 [pid 5111] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5111] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5113 attached [pid 5113] set_robust_list(0x7f27388019e0, 24) = 0 [pid 5113] open("./file0", O_RDONLY) = 4 [pid 5113] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5111] <... futex resumed>) = 0 [pid 5113] getdents(4, [pid 5111] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5113] <... getdents resumed>0x20000100 /* 2 entries */, 76) = 48 [pid 5111] <... futex resumed>) = 0 [pid 5113] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5111] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5113] <... futex resumed>) = 0 [pid 5111] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5113] futex(0x7f273fd017b8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5112] <... mount resumed>) = 0 [pid 5112] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 5 [pid 5112] chdir(".") = 0 [pid 5112] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5112] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5111] exit_group(0 [pid 5113] <... futex resumed>) = ? [pid 5112] <... futex resumed>) = ? [pid 5111] <... exit_group resumed>) = ? [pid 5113] +++ exited with 0 +++ [pid 5112] +++ exited with 0 +++ [pid 5111] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5111, si_uid=0, si_status=0, si_utime=0, si_stime=14 /* 0.14 s */} --- umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(3, 0x555557149620 /* 4 entries */, 32768) = 112 umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0 unlink("./14/binderfs") = 0 umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) lstat("./14/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 umount2("./14/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./14/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getdents64(4, 0x555557151660 /* 2 entries */, 32768) = 48 getdents64(4, 0x555557151660 /* 0 entries */, 32768) = 0 close(4) = 0 [ 56.531491][ T5112] loop0: detected capacity change from 0 to 32768 rmdir("./14/file0") = 0 getdents64(3, 0x555557149620 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./14") = 0 mkdir("./15", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555571485d0) = 5114 ./strace-static-x86_64: Process 5114 attached [pid 5114] set_robust_list(0x5555571485e0, 24) = 0 [pid 5114] chdir("./15") = 0 [pid 5114] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5114] setpgid(0, 0) = 0 [pid 5114] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5114] write(3, "1000", 4) = 4 [pid 5114] close(3) = 0 [pid 5114] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5114] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5114] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f273fc02000 [pid 5114] mprotect(0x7f273fc03000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5114] clone(child_stack=0x7f273fc223f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tid=[5115], tls=0x7f273fc22700, child_tidptr=0x7f273fc229d0) = 5115 [pid 5114] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5114] futex(0x7f273fd017ac, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5115 attached [pid 5115] set_robust_list(0x7f273fc229e0, 24) = 0 [pid 5115] memfd_create("syzkaller", 0) = 3 [pid 5115] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f2737802000 [pid 5115] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5115] munmap(0x7f2737802000, 16777216) = 0 [pid 5115] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5115] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5115] close(3) = 0 [pid 5115] mkdir("./file0", 0777) = 0 [pid 5115] mount("/dev/loop0", "./file0", "jfs", MS_NOATIME, "nodiscard,nointegrity,usrquota,integrity,iocharset=iso8859-6,iocharset=iso8859-7,iocharset=cp866,") = 0 [pid 5115] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3 [pid 5115] chdir("./file0") = 0 [pid 5115] ioctl(4, LOOP_CLR_FD) = 0 [pid 5115] close(4) = 0 [pid 5115] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000 [pid 5114] <... futex resumed>) = 0 [pid 5114] futex(0x7f273fd017a8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5114] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5115] <... futex resumed>) = 1 [pid 5114] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f27387e1000 [pid 5114] mprotect(0x7f27387e2000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5114] clone(child_stack=0x7f27388013f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5116 attached [pid 5116] set_robust_list(0x7f27388019e0, 24 [pid 5114] <... clone resumed>, parent_tid=[5116], tls=0x7f2738801700, child_tidptr=0x7f27388019d0) = 5116 [pid 5116] <... set_robust_list resumed>) = 0 [pid 5114] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5116] open("./file0", O_RDONLY [pid 5114] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5116] <... open resumed>) = 4 [pid 5116] futex(0x7f273fd017bc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5114] <... futex resumed>) = 0 [pid 5114] futex(0x7f273fd017b8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5114] futex(0x7f273fd017bc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5116] <... futex resumed>) = 1 [pid 5116] getdents(4, [pid 5115] mkdir(".", 0777) = -1 EEXIST (File exists) [ 56.793749][ T5115] loop0: detected capacity change from 0 to 32768 [ 56.824885][ T5116] read_mapping_page failed! [ 56.830326][ T5116] ERROR: (device loop0): txCommit: [ 56.830326][ T5116] [pid 5115] mount(NULL, ".", 0x200000c0, MS_RDONLY|MS_REMOUNT|MS_DIRSYNC|MS_NOATIME|MS_SILENT|MS_I_VERSION|MS_STRICTATIME, "") = 0 [pid 5115] openat(AT_FDCWD, ".", O_RDONLY|O_DIRECTORY) = 5 [pid 5115] chdir(".") = 0 [pid 5115] futex(0x7f273fd017ac, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 56.838751][ T5116] ERROR: (device loop0): remounting filesystem as read-only [ 56.847272][ T5116] general protection fault, probably for non-canonical address 0xdffffc0000000029: 0000 [#1] PREEMPT SMP KASAN [ 56.858999][ T5116] KASAN: null-ptr-deref in range [0x0000000000000148-0x000000000000014f] [ 56.867397][ T5116] CPU: 1 PID: 5116 Comm: syz-executor317 Not tainted 6.1.0-syzkaller-13781-gaeba12b26c79 #0 [ 56.877460][ T5116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 56.887541][ T5116] RIP: 0010:txEnd+0x1dc/0x560 [ 56.892230][ T5116] Code: 00 84 c0 0f 85 d8 02 00 00 66 41 89 1e 41 0f b7 c5 89 05 e7 5c 0b 0f 4c 8b 74 24 08 49 8d 9e 4c 01 00 00 48 89 d8 48 c1 e8 03 <42> 8a 04 20 84 c0 0f 85 c8 02 00 00 8b 2b 8d 75 ff 89 33 31 ff e8 [ 56.911832][ T5116] RSP: 0018:ffffc90003d5f9f0 EFLAGS: 00010203 [ 56.917889][ T5116] RAX: 0000000000000029 RBX: 000000000000014c RCX: 0000000000000000 [ 56.925849][ T5116] RDX: ffff88807eb93a80 RSI: 0000000000000000 RDI: 0000000000000000 [ 56.933808][ T5116] RBP: 1ffff920004c6227 R08: ffffffff830c3c2f R09: fffffbfff20fb43a [ 56.941769][ T5116] R10: fffffbfff20fb43a R11: 1ffffffff20fb439 R12: dffffc0000000000 [ 56.949729][ T5116] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000110 [ 56.957689][ T5116] FS: 00007f2738801700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 56.966697][ T5116] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 56.973269][ T5116] CR2: 00007f273fc23000 CR3: 000000007e7a4000 CR4: 00000000003506e0 [ 56.981247][ T5116] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 56.989409][ T5116] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 56.997465][ T5116] Call Trace: [ 57.000736][ T5116] [ 57.003710][ T5116] jfs_readdir+0x277c/0x44b0 [ 57.008406][ T5116] ? dtInitRoot+0x6c0/0x6c0 [ 57.012919][ T5116] ? read_lock_is_recursive+0x10/0x10 [ 57.018374][ T5116] ? aa_path_link+0x11d0/0x11d0 [ 57.023227][ T5116] ? __might_sleep+0xc0/0xc0 [ 57.027818][ T5116] ? __mutex_lock_common+0x45f/0x26e0 [ 57.033189][ T5116] ? rcu_lock_release+0x9/0x20 [ 57.037946][ T5116] ? ptrace_notify+0x245/0x340 [ 57.042701][ T5116] ? __lock_acquire+0x1f60/0x1f60 [ 57.047980][ T5116] ? down_write_killable+0x1b1/0x290 [ 57.053259][ T5116] ? iterate_dir+0x147/0x5f0 [ 57.057958][ T5116] ? down_write+0x270/0x270 [ 57.062477][ T5116] ? security_file_permission+0x45f/0x5c0 [ 57.068305][ T5116] iterate_dir+0x257/0x5f0 [ 57.072723][ T5116] __se_sys_getdents+0x1db/0x4d0 [ 57.077670][ T5116] ? _raw_spin_unlock_irq+0x2a/0x40 [ 57.083038][ T5116] ? __x64_sys_getdents+0x80/0x80 [ 57.088128][ T5116] ? fillonedir+0x480/0x480 [ 57.092829][ T5116] ? syscall_enter_from_user_mode+0x2e/0x1d0 [ 57.098864][ T5116] ? syscall_enter_from_user_mode+0x86/0x1d0 [ 57.104955][ T5116] do_syscall_64+0x3d/0xb0 [ 57.109384][ T5116] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 57.115276][ T5116] RIP: 0033:0x7f273fc76709 [ 57.119688][ T5116] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 57.139479][ T5116] RSP: 002b:00007f27388012f8 EFLAGS: 00000246 ORIG_RAX: 000000000000004e [ 57.148609][ T5116] RAX: ffffffffffffffda RBX: 00007f273fd017b0 RCX: 00007f273fc76709 [ 57.156699][ T5116] RDX: 000000000000004c RSI: 0000000020000100 RDI: 0000000000000004 [ 57.164663][ T5116] RBP: 0030656c69662f2e R08: 0000000000000000 R09: 0000000000000000 [ 57.173393][ T5116] R10: 0000000000000000 R11: 0000000000000246 R12: 61746f7571727375 [ 57.181527][ T5116] R13: 726765746e696f6e R14: 7261637369646f6e R15: 00007f273fd017b8 [ 57.189566][ T5116] [pid 5115] futex(0x7f273fd017a8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5114] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 57.192752][ T5116] Modules linked in: [ 57.196882][ T5116] ---[ end trace 0000000000000000 ]--- [ 57.202417][ T5116] RIP: 0010:txEnd+0x1dc/0x560 [ 57.207118][ T5116] Code: 00 84 c0 0f 85 d8 02 00 00 66 41 89 1e 41 0f b7 c5 89 05 e7 5c 0b 0f 4c 8b 74 24 08 49 8d 9e 4c 01 00 00 48 89 d8 48 c1 e8 03 <42> 8a 04 20 84 c0 0f 85 c8 02 00 00 8b 2b 8d 75 ff 89 33 31 ff e8 [ 57.227131][ T5116] RSP: 0018:ffffc90003d5f9f0 EFLAGS: 00010203 [ 57.233758][ T5116] RAX: 0000000000000029 RBX: 000000000000014c RCX: 0000000000000000 [ 57.241859][ T5116] RDX: ffff88807eb93a80 RSI: 0000000000000000 RDI: 0000000000000000 [ 57.249862][ T5116] RBP: 1ffff920004c6227 R08: ffffffff830c3c2f R09: fffffbfff20fb43a [ 57.257843][ T5116] R10: fffffbfff20fb43a R11: 1ffffffff20fb439 R12: dffffc0000000000 [ 57.266015][ T5116] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000110 [ 57.274103][ T5116] FS: 00007f2738801700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 57.283094][ T5116] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.289855][ T5116] CR2: 00007f273fc23000 CR3: 000000007e7a4000 CR4: 00000000003506e0 [ 57.298049][ T5116] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.306342][ T5116] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.314366][ T5116] Kernel panic - not syncing: Fatal exception [ 57.320576][ T5116] Kernel Offset: disabled [ 57.325154][ T5116] Rebooting in 86400 seconds..