./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2947698597

<...>
Warning: Permanently added '10.128.1.61' (ECDSA) to the list of known hosts.
execve("./syz-executor2947698597", ["./syz-executor2947698597"], 0x7ffdcd615170 /* 10 vars */) = 0
brk(NULL)                               = 0x5555567fc000
brk(0x5555567fcc40)                     = 0x5555567fcc40
arch_prctl(ARCH_SET_FS, 0x5555567fc300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor2947698597", 4096) = 28
brk(0x55555681dc40)                     = 0x55555681dc40
brk(0x55555681e000)                     = 0x55555681e000
mprotect(0x7f02355d3000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555567fc5d0) = 5062
./strace-static-x86_64: Process 5062 attached
[pid  5062] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5062] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5062] setsid()                    = 1
[pid  5062] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5062] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5062] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5062] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5062] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5062] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5062] unshare(CLONE_NEWNS)        = 0
[pid  5062] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5062] unshare(CLONE_NEWIPC)       = 0
[pid  5062] unshare(CLONE_NEWCGROUP)    = 0
[pid  5062] unshare(CLONE_NEWUTS)       = 0
[pid  5062] unshare(CLONE_SYSVSEM)      = 0
[pid  5062] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5062] write(3, "16777216", 8)     = 8
[pid  5062] close(3)                    = 0
[pid  5062] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5062] write(3, "536870912", 9)    = 9
[pid  5062] close(3)                    = 0
[pid  5062] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5062] write(3, "1024", 4)         = 4
[pid  5062] close(3)                    = 0
[pid  5062] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5062] write(3, "8192", 4)         = 4
[pid  5062] close(3)                    = 0
[pid  5062] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5062] write(3, "1024", 4)         = 4
[pid  5062] close(3)                    = 0
[pid  5062] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5062] write(3, "1024", 4)         = 4
[pid  5062] close(3)                    = 0
[pid  5062] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5062] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5062] close(3)                    = 0
[pid  5062] getpid()                    = 1
[pid  5062] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5062] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5062] unshare(CLONE_NEWNET)       = 0
[pid  5062] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5062] write(3, "0 65535", 7)      = 7
[pid  5062] close(3)                    = 0
[pid  5062] mkdir("/dev/binderfs", 0777) = 0
[pid  5062] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5062] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5062] memfd_create("syzkaller", 0) = 3
[pid  5062] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f022d0f2000
[pid  5062] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 100454338) = 100454338
[pid  5062] munmap(0x7f022d0f2000, 100454338) = 0
[pid  5062] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5062] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5062] close(3)                    = 0
[pid  5062] mkdir("./file0", 0777)      = 0
syzkaller login: [   40.548878][ T5062] loop0: detected capacity change from 0 to 196199
[   40.561086][ T5062] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz"
[   40.569401][ T5062] gfs2: fsid=syz:syz: Now mounting FS (format 1801)...
[   40.580791][ T5062] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms
[   40.589899][    T7] gfs2: fsid=syz:syz.0: jid=0, already locked for use
[   40.596710][    T7] gfs2: fsid=syz:syz.0: jid=0: Looking at journal...
[   40.624400][    T7] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 27ms
[   40.632292][    T7] gfs2: fsid=syz:syz.0: jid=0: Done
[   40.637801][ T5062] gfs2: fsid=syz:syz.0: first mount done, others may mount
[pid  5062] mount("/dev/loop0", "./file0", "gfs2", 0, "") = 0
[pid  5062] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid  5062] chdir("./file0")            = 0
[pid  5062] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5062] close(4)                    = 0
[pid  5062] exit_group(1)               = ?
[   40.729180][ T5062] general protection fault, probably for non-canonical address 0xdffffc0000000011: 0000 [#1] PREEMPT SMP KASAN
[   40.740943][ T5062] KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]
[   40.749367][ T5062] CPU: 0 PID: 5062 Comm: syz-executor294 Not tainted 6.2.0-rc4-syzkaller-00467-gf67144022885 #0
[   40.759809][ T5062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
[   40.769850][ T5062] RIP: 0010:gfs2_evict_inode+0xf0e/0x1c50
[   40.775573][ T5062] Code: 03 80 3c 02 00 0f 85 28 0d 00 00 48 8b 9d 00 09 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 8c 00 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 f8
[   40.795177][ T5062] RSP: 0018:ffffc90003eff8b8 EFLAGS: 00010217
[   40.801243][ T5062] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   40.809203][ T5062] RDX: 0000000000000011 RSI: ffffffff8394e5fd RDI: 000000000000008c
[   40.817189][ T5062] RBP: ffff888079524000 R08: 0000000000000005 R09: 0000000000000000
[   40.825182][ T5062] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
[   40.833167][ T5062] R13: ffff888076fe8d98 R14: ffff888076fe9228 R15: ffff888076fe8d70
[   40.841152][ T5062] FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
[   40.850086][ T5062] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   40.856663][ T5062] CR2: 00007f02355d7140 CR3: 000000000c48e000 CR4: 0000000000350ef0
[   40.864646][ T5062] Call Trace:
[   40.867920][ T5062]  <TASK>
[   40.870894][ T5062]  ? lockdep_hardirqs_on_prepare+0x410/0x410
[   40.876893][ T5062]  ? lockdep_hardirqs_on_prepare+0x410/0x410
[   40.882884][ T5062]  ? gfs2_statfs+0xb70/0xb70
[   40.887481][ T5062]  ? evict+0x2ed/0x6b0
[   40.891547][ T5062]  ? evict+0x2b7/0x6b0
[   40.895639][ T5062]  ? lock_downgrade+0x6e0/0x6e0
[   40.900495][ T5062]  ? sugov_start+0x580/0x580
[   40.905078][ T5062]  ? rwlock_bug.part.0+0x90/0x90
[   40.910012][ T5062]  ? gfs2_statfs+0xb70/0xb70
[   40.914605][ T5062]  evict+0x2ed/0x6b0
[   40.918497][ T5062]  iput.part.0+0x59b/0x880
[   40.922907][ T5062]  iput+0x5c/0x80
[   40.926534][ T5062]  gfs2_jindex_free+0x391/0x560
[   40.931386][ T5062]  ? gfs2_show_options+0xde0/0xde0
[   40.936494][ T5062]  ? gfs2_clear_rgrpd+0x52/0x330
[   40.941461][ T5062]  gfs2_put_super+0x48f/0x670
[   40.946162][ T5062]  ? free_local_statfs_inodes+0x370/0x370
[   40.951897][ T5062]  generic_shutdown_super+0x158/0x410
[   40.957294][ T5062]  kill_block_super+0x9b/0xf0
[   40.961975][ T5062]  gfs2_kill_sb+0x108/0x170
[   40.966475][ T5062]  deactivate_locked_super+0x98/0x160
[   40.972459][ T5062]  deactivate_super+0xb1/0xd0
[   40.977146][ T5062]  cleanup_mnt+0x2ae/0x3d0
[   40.981572][ T5062]  task_work_run+0x16f/0x270
[   40.986188][ T5062]  ? task_work_cancel+0x30/0x30
[   40.991038][ T5062]  do_exit+0xaa8/0x2950
[   40.995193][ T5062]  ? lock_downgrade+0x6e0/0x6e0
[   41.000036][ T5062]  ? do_raw_spin_lock+0x124/0x2b0
[   41.005058][ T5062]  ? mm_update_next_owner+0x7b0/0x7b0
[   41.010435][ T5062]  ? rwlock_bug.part.0+0x90/0x90
[   41.015367][ T5062]  ? _raw_spin_unlock_irq+0x23/0x50
[   41.020564][ T5062]  do_group_exit+0xd4/0x2a0
[   41.025072][ T5062]  __x64_sys_exit_group+0x3e/0x50
[   41.030106][ T5062]  do_syscall_64+0x39/0xb0
[   41.034614][ T5062]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   41.040500][ T5062] RIP: 0033:0x7f023553d999
[   41.044902][ T5062] Code: Unable to access opcode bytes at 0x7f023553d96f.
[   41.051911][ T5062] RSP: 002b:00007fff98fbb388 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   41.060319][ T5062] RAX: ffffffffffffffda RBX: 00007f02355d9330 RCX: 00007f023553d999
[   41.068281][ T5062] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
[   41.076333][ T5062] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00000000000262db
[   41.084312][ T5062] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f02355d9330
[   41.092280][ T5062] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
[   41.100255][ T5062]  </TASK>
[   41.103259][ T5062] Modules linked in:
[   41.107793][ T5062] ---[ end trace 0000000000000000 ]---
[   41.113568][ T5062] RIP: 0010:gfs2_evict_inode+0xf0e/0x1c50
[   41.119532][ T5062] Code: 03 80 3c 02 00 0f 85 28 0d 00 00 48 8b 9d 00 09 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 8c 00 00 00 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 f8
[   41.139495][ T5062] RSP: 0018:ffffc90003eff8b8 EFLAGS: 00010217
[   41.145627][ T5062] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
[   41.153688][ T5062] RDX: 0000000000000011 RSI: ffffffff8394e5fd RDI: 000000000000008c
[   41.161708][ T5062] RBP: ffff888079524000 R08: 0000000000000005 R09: 0000000000000000
[   41.169763][ T5062] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
[   41.177809][ T5062] R13: ffff888076fe8d98 R14: ffff888076fe9228 R15: ffff888076fe8d70
[   41.185838][ T5062] FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
[   41.194889][ T5062] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   41.201509][ T5062] CR2: 00007f02355d7140 CR3: 0000000029a8b000 CR4: 0000000000350ef0
[   41.209522][ T5062] Kernel panic - not syncing: Fatal exception
[   41.216345][ T5062] Kernel Offset: disabled
[   41.220658][ T5062] Rebooting in 86400 seconds..