./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4186311347 <...> Warning: Permanently added '10.128.0.145' (ECDSA) to the list of known hosts. execve("./syz-executor4186311347", ["./syz-executor4186311347"], 0x7ffd7df53db0 /* 10 vars */) = 0 brk(NULL) = 0x5555569e3000 brk(0x5555569e3d00) = 0x5555569e3d00 arch_prctl(ARCH_SET_FS, 0x5555569e33c0) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor4186311347", 4096) = 28 brk(0x555556a04d00) = 0x555556a04d00 brk(0x555556a05000) = 0x555556a05000 mprotect(0x7f5d7e5d7000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 mount(NULL, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, NULL) = -1 EBUSY (Device or resource busy) openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x30\x3a\x4d\x3a\x30\x3a\x01\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a", 21) = 21 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x31\x3a\x4d\x3a\x31\x3a\x02\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a\x50\x4f\x43", 24) = 24 close(3) = 0 socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=704, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5065}, "\x01\x02\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00\x06\x00\x01\x00\x1c\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x26\x00\x00\x00\x48\x02\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00"...], 4096, 0, NULL, NULL) = 704 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5065}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 access("/proc/net", R_OK) = 0 access("/proc/net/unix", R_OK) = 0 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x06\x00\x0a\x00\xa0\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5065}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5065}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 sendto(3, [{nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 68, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 68 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5065}, {error=0, msg={nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x06\x00\x0a\x00\xa1\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5065}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5065}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 close(3) = 0 close(4) = 0 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7f5d7e501100, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f5d7e5051d0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7f5d7e501100, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7f5d7e5051d0}, NULL, 8) = 0 getpid() = 5065 mkdir("./syzkaller.5OyjSd", 0700) = 0 chmod("./syzkaller.5OyjSd", 0777) = 0 chdir("./syzkaller.5OyjSd") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555569e3690) = 5068 ./strace-static-x86_64: Process 5068 attached [pid 5068] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5068] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5068] setsid() = 1 [pid 5068] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5068] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5068] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5068] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5068] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5068] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5068] unshare(CLONE_NEWNS) = 0 [pid 5068] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5068] unshare(CLONE_NEWIPC) = 0 [pid 5068] unshare(CLONE_NEWCGROUP) = 0 [pid 5068] unshare(CLONE_NEWUTS) = 0 [pid 5068] unshare(CLONE_SYSVSEM) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "16777216", 8) = 8 [pid 5068] close(3) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "536870912", 9) = 9 [pid 5068] close(3) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "1024", 4) = 4 [pid 5068] close(3) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "8192", 4) = 4 [pid 5068] close(3) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "1024", 4) = 4 [pid 5068] close(3) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "1024", 4) = 4 [pid 5068] close(3) = 0 [pid 5068] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5068] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5068] close(3) = 0 [pid 5068] getpid() = 1 [pid 5068] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 0b e8 7b 11 9c ff 0f 0b e8 74 11 9c ff 0f 0b e8 6d 11 9c ff 0f [ 44.831919][ T5068] RSP: 0018:ffffc90003f3fae8 EFLAGS: 00010093 [ 44.837998][ T5068] RAX: 0000000000000000 RBX: ffff88807326a420 RCX: 0000000000000000 [ 44.845950][ T5068] RDX: ffff888025deba80 RSI: ffffffff81e4e68e RDI: 0000000000000007 [ 44.853897][ T5068] RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000 [ 44.861845][ T5068] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88807326a650 [ 44.869796][ T5068] R13: ffff88807326a448 R14: ffffffff8a81de80 R15: ffff88807326a150 [ 44.877757][ T5068] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 44.886677][ T5068] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.893248][ T5068] CR2: 00007f5d7e58cb88 CR3: 000000000c48e000 CR4: 0000000000350ee0 [ 44.901231][ T5068] Call Trace: [ 44.904500][ T5068] [ 44.907418][ T5068] ntfs_evict_big_inode+0x41/0x520 [ 44.912521][ T5068] ? __ntfs_write_inode+0xc40/0xc40 [ 44.917706][ T5068] evict+0x2ed/0x6b0 [ 44.921600][ T5068] iput.part.0+0x59b/0x880 [ 44.926010][ T5068] iput+0x5c/0x80 [ 44.929637][ T5068] ntfs_put_super+0x979/0x1700 [ 44.934392][ T5068] ? ntfs_fill_super+0x92d0/0x92d0 [ 44.939495][ T5068] generic_shutdown_super+0x158/0x410 [ 44.944857][ T5068] kill_block_super+0x9b/0xf0 [ 44.949525][ T5068] deactivate_locked_super+0x98/0x160 [ 44.954888][ T5068] deactivate_super+0xb1/0xd0 [ 44.959557][ T5068] cleanup_mnt+0x2ae/0x3d0 [ 44.963966][ T5068] task_work_run+0x16f/0x270 [ 44.968551][ T5068] ? task_work_cancel+0x30/0x30 [ 44.973394][ T5068] do_exit+0xaa8/0x2950 [ 44.977542][ T5068] ? lock_downgrade+0x6e0/0x6e0 [ 44.982387][ T5068] ? do_raw_spin_lock+0x124/0x2b0 [ 44.987396][ T5068] ? mm_update_next_owner+0x7b0/0x7b0 [ 44.992763][ T5068] ? rwlock_bug.part.0+0x90/0x90 [ 44.997691][ T5068] ? _raw_spin_unlock_irq+0x23/0x50 [ 45.002889][ T5068] do_group_exit+0xd4/0x2a0 [ 45.007390][ T5068] __x64_sys_exit_group+0x3e/0x50 [ 45.012408][ T5068] do_syscall_64+0x39/0xb0 [ 45.016812][ T5068] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 45.022701][ T5068] RIP: 0033:0x7f5d7e546449 [ 45.027100][ T5068] Code: Unable to access opcode bytes at 0x7f5d7e54641f. [ 45.034096][ T5068] RSP: 002b:00007fffddbaa318 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 45.042494][ T5068] RAX: ffffffffffffffda RBX: 00007f5d7e5dd410 RCX: 00007f5d7e546449 [ 45.050475][ T5068] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 45.058436][ T5068] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 000000000001ee3c [ 45.066392][ T5068] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5d7e5dd410 [ 45.074349][ T5068] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 45.082309][ T5068] [ 45.085319][ T5068] Modules linked in: [ 45.089204][ T5068] ---[ end trace 0000000000000000 ]--- [ 45.094639][ T5068] RIP: 0010:clear_inode+0x13e/0x190 [ 45.099832][ T5068] Code: 02 00 75 65 48 8b 83 d8 01 00 00 48 39 c5 75 31 e8 97 11 9c ff 48 c7 83 d8 00 00 00 60 00 00 00 5b 5d 41 5c c3 e8 82 11 9c ff <0f> 0b e8 7b 11 9c ff 0f 0b e8 74 11 9c ff 0f 0b e8 6d 11 9c ff 0f [ 45.119438][ T5068] RSP: 0018:ffffc90003f3fae8 EFLAGS: 00010093 [ 45.125491][ T5068] RAX: 0000000000000000 RBX: ffff88807326a420 RCX: 0000000000000000 [ 45.133448][ T5068] RDX: ffff888025deba80 RSI: ffffffff81e4e68e RDI: 0000000000000007 [ 45.141405][ T5068] RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000000000 [ 45.149361][ T5068] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88807326a650 [ 45.157318][ T5068] R13: ffff88807326a448 R14: ffffffff8a81de80 R15: ffff88807326a150 [ 45.165277][ T5068] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 [ 45.174190][ T5068] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.180763][ T5068] CR2: 00007f5d7e58cb88 CR3: 000000000c48e000 CR4: 0000000000350ee0 [ 45.188723][ T5068] Kernel panic - not syncing: Fatal exception [ 45.195698][ T5068] Kernel Offset: disabled [ 45.200009][ T5068] Rebooting in 86400 seconds..