./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor100815378 <...> syzkaller login: [ 92.157922][ T975] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.0.99' (ED25519) to the list of known hosts. execve("./syz-executor100815378", ["./syz-executor100815378"], 0x7fff96b39190 /* 10 vars */) = 0 brk(NULL) = 0x555561216000 brk(0x555561216d40) = 0x555561216d40 arch_prctl(ARCH_SET_FS, 0x5555612163c0) = 0 set_tid_address(0x555561216690) = 5826 set_robust_list(0x5555612166a0, 24) = 0 rseq(0x555561216ce0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor100815378", 4096) = 27 getrandom("\x74\x61\xe4\xa9\xb0\x6e\xa4\xc7", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555561216d40 brk(0x555561237d40) = 0x555561237d40 brk(0x555561238000) = 0x555561238000 mprotect(0x7f47694fe000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=864, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5826}, "\x01\x02\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00\x06\x00\x01\x00\x1d\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x30\x00\x00\x00\xe8\x02\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00"...], 4096, 0, NULL, NULL) = 864 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5826}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x06\x00\x0a\x00\xa0\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5826}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5826}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 sendto(3, [{nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 68, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 68 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5826}, {error=0, msg={nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x06\x00\x0a\x00\xa1\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36 recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5826}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0 close(5) = 0 sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44 recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5826}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 close(3) = 0 close(4) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5829 attached , child_tidptr=0x555561216690) = 5829 [pid 5826] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] set_robust_list(0x5555612166a0, 24) = 0 ./strace-static-x86_64: Process 5830 attached [pid 5826] <... clone resumed>, child_tidptr=0x555561216690) = 5830 [pid 5829] mkdir("./syzkaller.8LjVG2", 0700 [pid 5826] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5830] set_robust_list(0x5555612166a0, 24) = 0 ./strace-static-x86_64: Process 5831 attached [pid 5829] <... mkdir resumed>) = 0 [pid 5826] <... clone resumed>, child_tidptr=0x555561216690) = 5831 [pid 5831] set_robust_list(0x5555612166a0, 24 [pid 5826] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5830] mkdir("./syzkaller.YVSFj5", 0700 [pid 5829] chmod("./syzkaller.8LjVG2", 0777./strace-static-x86_64: Process 5832 attached [pid 5831] <... set_robust_list resumed>) = 0 [pid 5829] <... chmod resumed>) = 0 [pid 5826] <... clone resumed>, child_tidptr=0x555561216690) = 5832 [pid 5832] set_robust_list(0x5555612166a0, 24 [pid 5831] mkdir("./syzkaller.V2krIO", 0700 [pid 5830] <... mkdir resumed>) = 0 [pid 5832] <... set_robust_list resumed>) = 0 [pid 5829] chdir("./syzkaller.8LjVG2" [pid 5830] chmod("./syzkaller.YVSFj5", 0777 [pid 5826] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5832] mkdir("./syzkaller.p5as4z", 0700 [pid 5829] <... chdir resumed>) = 0 [pid 5830] <... chmod resumed>) = 0 [pid 5831] <... mkdir resumed>) = 0 [pid 5830] chdir("./syzkaller.YVSFj5" [pid 5829] mkdir("./0", 0777 [pid 5830] <... chdir resumed>) = 0 [pid 5829] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5833 attached [pid 5833] set_robust_list(0x5555612166a0, 24 [pid 5832] <... mkdir resumed>) = 0 [pid 5831] chmod("./syzkaller.V2krIO", 0777 [pid 5830] mkdir("./0", 0777 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5826] <... clone resumed>, child_tidptr=0x555561216690) = 5833 [pid 5833] <... set_robust_list resumed>) = 0 [pid 5832] chmod("./syzkaller.p5as4z", 0777 [pid 5831] <... chmod resumed>) = 0 [pid 5831] chdir("./syzkaller.V2krIO") = 0 [pid 5829] <... openat resumed>) = 3 [pid 5833] getrandom( [pid 5832] <... chmod resumed>) = 0 [pid 5830] <... mkdir resumed>) = 0 [pid 5833] <... getrandom resumed>"\xce\xfc\xde\x4f\x42\x0d\x06\x59", 8, GRND_NONBLOCK) = 8 [pid 5831] mkdir("./0", 0777 [pid 5829] ioctl(3, LOOP_CLR_FD [pid 5832] chdir("./syzkaller.p5as4z" [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5832] <... chdir resumed>) = 0 [pid 5833] mkdir("./syzkaller.aJvMJg", 0700 [pid 5832] mkdir("./0", 0777 [pid 5829] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5833] <... mkdir resumed>) = 0 [pid 5831] <... mkdir resumed>) = 0 [pid 5830] <... openat resumed>) = 3 [pid 5829] close(3 [pid 5833] chmod("./syzkaller.aJvMJg", 0777 [pid 5832] <... mkdir resumed>) = 0 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5829] <... close resumed>) = 0 [pid 5831] <... openat resumed>) = 3 [pid 5830] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5833] <... chmod resumed>) = 0 [pid 5833] chdir("./syzkaller.aJvMJg" [pid 5830] close(3 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5834 attached [pid 5833] <... chdir resumed>) = 0 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5830] <... close resumed>) = 0 [pid 5833] mkdir("./0", 0777 [pid 5832] <... openat resumed>) = 3 [pid 5831] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5835 attached [pid 5834] set_robust_list(0x5555612166a0, 24 [pid 5833] <... mkdir resumed>) = 0 [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5831] close(3 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5834 [pid 5831] <... close resumed>) = 0 [pid 5834] <... set_robust_list resumed>) = 0 [pid 5832] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5835] set_robust_list(0x5555612166a0, 24 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5836 attached [pid 5835] <... set_robust_list resumed>) = 0 [pid 5834] chdir("./0" [pid 5836] set_robust_list(0x5555612166a0, 24 [pid 5835] chdir("./0" [pid 5834] <... chdir resumed>) = 0 [pid 5836] <... set_robust_list resumed>) = 0 [pid 5834] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5832] close(3 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5835 [pid 5835] <... chdir resumed>) = 0 [pid 5834] <... prctl resumed>) = 0 [pid 5836] chdir("./0" [pid 5835] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5834] setpgid(0, 0 [pid 5832] <... close resumed>) = 0 [pid 5836] <... chdir resumed>) = 0 [pid 5835] <... prctl resumed>) = 0 [pid 5834] <... setpgid resumed>) = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5837 attached [pid 5836] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5835] setpgid(0, 0 [pid 5834] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5835] <... setpgid resumed>) = 0 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5837] set_robust_list(0x5555612166a0, 24 [pid 5836] <... prctl resumed>) = 0 [pid 5835] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5834] <... openat resumed>) = 3 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5837 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5836 [pid 5837] <... set_robust_list resumed>) = 0 [pid 5836] setpgid(0, 0 [pid 5835] <... openat resumed>) = 3 [pid 5834] write(3, "1000", 4 [pid 5833] <... openat resumed>) = 3 [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5837] chdir("./0" [pid 5836] <... setpgid resumed>) = 0 [pid 5835] write(3, "1000", 4 [pid 5834] <... write resumed>) = 4 [pid 5835] <... write resumed>) = 4 [pid 5834] close(3 [pid 5835] close(3 [pid 5834] <... close resumed>) = 0 [pid 5833] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5837] <... chdir resumed>) = 0 [pid 5835] <... close resumed>) = 0 [pid 5834] symlink("/dev/binderfs", "./binderfs" [pid 5833] close(3 [pid 5836] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5833] <... close resumed>) = 0 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5836] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5838 attached [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5838 [pid 5838] set_robust_list(0x5555612166a0, 24 [pid 5834] <... symlink resumed>) = 0 [pid 5836] write(3, "1000", 4 [pid 5838] <... set_robust_list resumed>) = 0 [pid 5838] chdir("./0") = 0 [pid 5838] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5838] setpgid(0, 0) = 0 [pid 5838] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5838] write(3, "1000", 4) = 4 [pid 5838] close(3) = 0 [pid 5838] symlink("/dev/binderfs", "./binderfs" [pid 5836] <... write resumed>) = 4 executing program [pid 5835] symlink("/dev/binderfs", "./binderfs" [pid 5837] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5834] write(1, "executing program\n", 18 [pid 5837] <... prctl resumed>) = 0 [pid 5836] close(3 [pid 5834] <... write resumed>) = 18 [pid 5837] setpgid(0, 0 [pid 5834] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5837] <... setpgid resumed>) = 0 [pid 5836] <... close resumed>) = 0 [pid 5835] <... symlink resumed>) = 0 [pid 5834] <... futex resumed>) = 0 [pid 5836] symlink("/dev/binderfs", "./binderfs" [pid 5834] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, executing program executing program [pid 5837] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5836] <... symlink resumed>) = 0 [pid 5834] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5834] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5835] write(1, "executing program\n", 18) = 18 [pid 5837] <... openat resumed>) = 3 [pid 5834] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5836] write(1, "executing program\n", 18 [pid 5837] write(3, "1000", 4 [pid 5834] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5836] <... write resumed>) = 18 [pid 5835] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5834] <... mmap resumed>) = 0x7f476940f000 [pid 5836] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5834] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5836] <... futex resumed>) = 0 [pid 5835] <... futex resumed>) = 0 [pid 5835] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5834] <... mprotect resumed>) = 0 [pid 5836] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5835] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5835] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5835] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5836] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5835] <... mmap resumed>) = 0x7f476940f000 [pid 5834] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5836] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5835] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5834] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5838] <... symlink resumed>) = 0 [pid 5837] <... write resumed>) = 4 [pid 5836] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5835] <... mprotect resumed>) = 0 [pid 5834] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5838] write(1, "executing program\n", 18 [pid 5837] close(3 [pid 5836] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0executing program [pid 5835] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 5839 attached [pid 5838] <... write resumed>) = 18 [pid 5837] <... close resumed>) = 0 [pid 5836] <... mmap resumed>) = 0x7f476940f000 [pid 5835] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5834] <... clone3 resumed> => {parent_tid=[5839]}, 88) = 5839 [pid 5839] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5836] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5835] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5839] <... rseq resumed>) = 0 [pid 5838] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5837] symlink("/dev/binderfs", "./binderfs" [pid 5836] <... mprotect resumed>) = 0 [pid 5834] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5840 attached [pid 5839] set_robust_list(0x7f476942f9a0, 24 [pid 5838] <... futex resumed>) = 0 [pid 5836] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5840] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5839] <... set_robust_list resumed>) = 0 [pid 5838] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5837] <... symlink resumed>) = 0 [pid 5836] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5835] <... clone3 resumed> => {parent_tid=[5840]}, 88) = 5840 [pid 5834] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5840] <... rseq resumed>) = 0 [pid 5839] rt_sigprocmask(SIG_SETMASK, [], [pid 5838] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5840] set_robust_list(0x7f476942f9a0, 24 [pid 5839] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5835] rt_sigprocmask(SIG_SETMASK, [], [pid 5840] <... set_robust_list resumed>) = 0 [pid 5839] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5840] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5838] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5834] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5840] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5839] <... futex resumed>) = 0 [pid 5838] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5836] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5835] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5834] <... futex resumed>) = 1 ./strace-static-x86_64: Process 5841 attached [pid 5839] memfd_create("syzkaller", 0 [pid 5838] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 executing program [pid 5837] write(1, "executing program\n", 18 [pid 5835] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5834] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5841] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5840] <... futex resumed>) = 0 [pid 5839] <... memfd_create resumed>) = 3 [pid 5838] <... mmap resumed>) = 0x7f476940f000 [pid 5837] <... write resumed>) = 18 [pid 5836] <... clone3 resumed> => {parent_tid=[5841]}, 88) = 5841 [pid 5835] <... futex resumed>) = 1 [pid 5838] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5836] rt_sigprocmask(SIG_SETMASK, [], [pid 5841] <... rseq resumed>) = 0 [pid 5840] memfd_create("syzkaller", 0 [pid 5839] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5838] <... mprotect resumed>) = 0 [pid 5837] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5836] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5835] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5841] set_robust_list(0x7f476942f9a0, 24 [pid 5840] <... memfd_create resumed>) = 3 [pid 5839] <... mmap resumed>) = 0x7f4761000000 [pid 5838] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5837] <... futex resumed>) = 0 [pid 5836] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5841] <... set_robust_list resumed>) = 0 [pid 5838] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5837] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5836] <... futex resumed>) = 0 [pid 5841] rt_sigprocmask(SIG_SETMASK, [], [pid 5840] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5839] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5838] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5837] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5836] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5842 attached [pid 5841] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5840] <... mmap resumed>) = 0x7f4761000000 [pid 5837] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5842] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5838] <... clone3 resumed> => {parent_tid=[5842]}, 88) = 5842 [pid 5842] <... rseq resumed>) = 0 [pid 5838] rt_sigprocmask(SIG_SETMASK, [], [pid 5837] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5842] set_robust_list(0x7f476942f9a0, 24 [pid 5840] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5837] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5842] <... set_robust_list resumed>) = 0 [pid 5841] memfd_create("syzkaller", 0 [pid 5838] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5837] <... mmap resumed>) = 0x7f476940f000 [pid 5842] rt_sigprocmask(SIG_SETMASK, [], [pid 5841] <... memfd_create resumed>) = 3 [pid 5838] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5842] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5841] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5839] <... write resumed>) = 131072 [pid 5838] <... futex resumed>) = 0 [pid 5842] memfd_create("syzkaller", 0 [pid 5841] <... mmap resumed>) = 0x7f4761000000 [pid 5839] munmap(0x7f4761000000, 138412032 [pid 5838] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5837] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5841] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5837] <... mprotect resumed>) = 0 [pid 5839] <... munmap resumed>) = 0 [pid 5837] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5842] <... memfd_create resumed>) = 3 [pid 5840] <... write resumed>) = 131072 [pid 5839] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5837] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5842] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5840] munmap(0x7f4761000000, 138412032 [pid 5839] <... openat resumed>) = 4 [pid 5837] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5842] <... mmap resumed>) = 0x7f4761000000 [pid 5840] <... munmap resumed>) = 0 ./strace-static-x86_64: Process 5843 attached [pid 5842] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5841] <... write resumed>) = 131072 [pid 5839] ioctl(4, LOOP_SET_FD, 3 [pid 5843] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5837] <... clone3 resumed> => {parent_tid=[5843]}, 88) = 5843 [pid 5843] <... rseq resumed>) = 0 [pid 5837] rt_sigprocmask(SIG_SETMASK, [], [pid 5843] set_robust_list(0x7f476942f9a0, 24 [pid 5837] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5843] <... set_robust_list resumed>) = 0 [pid 5837] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5843] rt_sigprocmask(SIG_SETMASK, [], [pid 5842] <... write resumed>) = 131072 [pid 5837] <... futex resumed>) = 0 [pid 5843] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5841] munmap(0x7f4761000000, 138412032 [pid 5840] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5837] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5843] memfd_create("syzkaller", 0 [pid 5841] <... munmap resumed>) = 0 [pid 5840] <... openat resumed>) = 4 [pid 5843] <... memfd_create resumed>) = 3 [pid 5841] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5840] ioctl(4, LOOP_SET_FD, 3 [pid 5843] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5842] munmap(0x7f4761000000, 138412032 [pid 5843] <... mmap resumed>) = 0x7f4761000000 [pid 5841] <... openat resumed>) = 4 [pid 5843] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5841] ioctl(4, LOOP_SET_FD, 3 [pid 5842] <... munmap resumed>) = 0 [pid 5842] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 5842] ioctl(4, LOOP_SET_FD, 3 [pid 5843] <... write resumed>) = 131072 [pid 5843] munmap(0x7f4761000000, 138412032) = 0 [pid 5843] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 5843] ioctl(4, LOOP_SET_FD, 3 [pid 5842] <... ioctl resumed>) = 0 [pid 5840] <... ioctl resumed>) = 0 [pid 5843] <... ioctl resumed>) = 0 [pid 5841] <... ioctl resumed>) = 0 [pid 5839] <... ioctl resumed>) = 0 [pid 5842] close(3) = 0 [pid 5842] close(4) = 0 [pid 5843] close(3 [pid 5841] close(3 [pid 5840] close(3 [pid 5839] close(3 [pid 5840] <... close resumed>) = 0 [pid 5843] <... close resumed>) = 0 [pid 5842] mkdir("./file1", 0777 [pid 5841] <... close resumed>) = 0 [pid 5839] <... close resumed>) = 0 [pid 5843] close(4 [pid 5842] <... mkdir resumed>) = 0 [pid 5841] close(4 [pid 5840] close(4 [pid 5839] close(4 [pid 5843] <... close resumed>) = 0 [pid 5842] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5841] <... close resumed>) = 0 [pid 5841] mkdir("./file1", 0777 [pid 5840] <... close resumed>) = 0 [pid 5839] <... close resumed>) = 0 [ 96.148124][ T5840] loop1: detected capacity change from 0 to 256 [ 96.154677][ T5842] loop4: detected capacity change from 0 to 256 [ 96.157347][ T5841] loop2: detected capacity change from 0 to 256 [ 96.171169][ T5839] loop0: detected capacity change from 0 to 256 [ 96.171198][ T5843] loop3: detected capacity change from 0 to 256 [pid 5843] mkdir("./file1", 0777 [pid 5841] <... mkdir resumed>) = 0 [pid 5840] mkdir("./file1", 0777 [pid 5839] mkdir("./file1", 0777 [pid 5840] <... mkdir resumed>) = 0 [pid 5839] <... mkdir resumed>) = 0 [pid 5841] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5840] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 5843] <... mkdir resumed>) = 0 [pid 5839] mount("/dev/loop0", "./file1", "exfat", 0, "" [ 96.270703][ T5842] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 96.295090][ T5841] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5843] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5842] <... mount resumed>) = 0 [pid 5842] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [ 96.300796][ T5840] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 96.313501][ T5839] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5842] chdir("./file1" [pid 5841] <... mount resumed>) = 0 [pid 5840] <... mount resumed>) = 0 [pid 5839] <... mount resumed>) = 0 [pid 5843] <... mount resumed>) = 0 [pid 5842] <... chdir resumed>) = 0 [pid 5841] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5840] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [ 96.370280][ T5843] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5839] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5843] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5842] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5841] <... openat resumed>) = 3 [pid 5840] <... openat resumed>) = 3 [pid 5839] <... openat resumed>) = 3 [pid 5840] chdir("./file1" [pid 5839] chdir("./file1" [pid 5841] chdir("./file1" [pid 5842] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5841] <... chdir resumed>) = 0 [pid 5843] <... openat resumed>) = 3 [pid 5842] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5841] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5840] <... chdir resumed>) = 0 [pid 5839] <... chdir resumed>) = 0 [pid 5841] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5840] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5839] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5841] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5843] chdir("./file1" [pid 5842] <... futex resumed>) = 1 [pid 5840] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5842] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5841] <... futex resumed>) = 1 [pid 5843] <... chdir resumed>) = 0 [pid 5841] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5840] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5839] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5836] <... futex resumed>) = 0 [pid 5843] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5840] <... futex resumed>) = 1 [pid 5839] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5836] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5841] <... futex resumed>) = 0 [pid 5839] <... futex resumed>) = 1 [pid 5836] <... futex resumed>) = 1 [pid 5840] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5841] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5843] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5839] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5836] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5834] <... futex resumed>) = 0 [pid 5839] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5835] <... futex resumed>) = 0 [pid 5834] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5835] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5840] <... futex resumed>) = 0 [pid 5835] <... futex resumed>) = 1 [pid 5840] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5835] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5843] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5840] <... openat resumed>) = 4 [pid 5839] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5834] <... futex resumed>) = 0 [pid 5843] <... futex resumed>) = 1 [pid 5838] <... futex resumed>) = 0 [pid 5834] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5843] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5838] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5842] <... futex resumed>) = 0 [pid 5841] <... openat resumed>) = 4 [pid 5838] <... futex resumed>) = 1 [pid 5842] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5841] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5838] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5840] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5842] <... openat resumed>) = 4 [pid 5835] <... futex resumed>) = 0 [pid 5841] <... futex resumed>) = 1 [pid 5842] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5836] <... futex resumed>) = 0 [pid 5842] <... futex resumed>) = 0 [pid 5841] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5838] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5836] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5842] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5836] <... futex resumed>) = 0 [pid 5841] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5836] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5841] mkdir("./file2", 0777 [pid 5840] mkdir("./file2", 0777 [pid 5835] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5840] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5835] <... futex resumed>) = 0 [pid 5835] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5840] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5835] <... futex resumed>) = ? [pid 5840] +++ killed by SIGSEGV +++ [pid 5835] +++ killed by SIGSEGV +++ [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5835, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5830] restart_syscall(<... resuming interrupted clone ...> [pid 5838] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5837] <... futex resumed>) = 0 [pid 5830] <... restart_syscall resumed>) = 0 [pid 5830] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5830] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5830] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5842] <... futex resumed>) = 0 [pid 5839] <... openat resumed>) = 4 [pid 5838] <... futex resumed>) = 1 [pid 5837] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... umount2 resumed>) = 0 [pid 5843] <... futex resumed>) = 0 [pid 5842] mkdir("./file2", 0777 [pid 5841] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5839] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5838] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5837] <... futex resumed>) = 1 [pid 5836] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5834] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5830] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5839] <... futex resumed>) = 0 [pid 5837] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5836] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5834] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 96.465199][ T5840] exFAT-fs (loop1): error, data size is invalid(9000) [ 96.465199][ T5841] exFAT-fs (loop2): error, data size is invalid(9000) [ 96.465259][ T5840] exFAT-fs (loop1): Filesystem has been set read-only [ 96.506013][ T5841] exFAT-fs (loop2): Filesystem has been set read-only [pid 5830] newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5836] <... futex resumed>) = 0 [pid 5834] <... futex resumed>) = 0 [pid 5830] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5843] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5841] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5839] mkdir("./file2", 0777 [pid 5836] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5834] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] <... openat resumed>) = 4 [pid 5830] newfstatat(4, "", [pid 5836] <... mmap resumed>) = ? [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5843] <... openat resumed>) = 4 [pid 5842] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5841] +++ killed by SIGSEGV +++ [pid 5836] +++ killed by SIGSEGV +++ [pid 5830] getdents64(4, [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5836, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] restart_syscall(<... resuming interrupted clone ...> [pid 5830] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] close(4) = 0 [pid 5830] rmdir("./0/file1" [pid 5843] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5842] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5838] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5831] <... restart_syscall resumed>) = 0 [pid 5838] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5837] <... futex resumed>) = 0 [pid 5837] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5843] <... futex resumed>) = 1 [pid 5838] <... futex resumed>) = ? [pid 5837] <... futex resumed>) = 0 [pid 5843] mkdir("./file2", 0777 [pid 5837] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 96.519040][ T5842] exFAT-fs (loop4): error, data size is invalid(9000) [ 96.529489][ T5842] exFAT-fs (loop4): Filesystem has been set read-only [ 96.533326][ T5839] exFAT-fs (loop0): error, data size is invalid(9000) [pid 5831] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5831] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] <... rmdir resumed>) = 0 [pid 5842] +++ killed by SIGSEGV +++ [pid 5838] +++ killed by SIGSEGV +++ [pid 5834] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5831] getdents64(3, [pid 5834] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5838, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5834] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5834] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5831] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5834] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5833] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5834] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5833] <... openat resumed>) = 3 [pid 5830] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] newfstatat(3, "", [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5834] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5833] getdents64(3, [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5847 attached [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5831] <... umount2 resumed>) = 0 [pid 5830] unlink("./0/binderfs" [pid 5847] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5834] <... clone3 resumed> => {parent_tid=[5847]}, 88) = 5847 [pid 5830] <... unlink resumed>) = 0 [pid 5847] <... rseq resumed>) = 0 [pid 5834] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5847] set_robust_list(0x7f476940e9a0, 24 [pid 5834] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] <... umount2 resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5847] <... set_robust_list resumed>) = 0 [ 96.575572][ T5843] exFAT-fs (loop3): error, data size is invalid(9000) [pid 5834] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] newfstatat(AT_FDCWD, "./0/file1", [pid 5837] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5837] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5834] <... futex resumed>) = 0 [pid 5847] rt_sigprocmask(SIG_SETMASK, [], [pid 5837] <... futex resumed>) = 0 [pid 5830] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5830] close(3) = 0 [pid 5830] rmdir("./0" [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] <... rmdir resumed>) = 0 [pid 5831] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5831] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] newfstatat(4, "", [pid 5830] mkdir("./1", 0777 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] <... mkdir resumed>) = 0 [pid 5831] getdents64(4, [pid 5833] newfstatat(AT_FDCWD, "./0/file1", [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] getdents64(4, [pid 5830] <... openat resumed>) = 3 [pid 5833] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] close(4 [pid 5830] <... ioctl resumed>) = 0 [pid 5847] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5837] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5834] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5847] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5837] <... mmap resumed>) = 0x7f47693ee000 [pid 5831] <... close resumed>) = 0 [pid 5830] close(3 [pid 5837] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5833] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] rmdir("./0/file1" [pid 5830] <... close resumed>) = 0 [pid 5847] <... ioctl resumed>) = 0 [pid 5837] <... mprotect resumed>) = 0 [pid 5833] <... openat resumed>) = 4 [pid 5831] <... rmdir resumed>) = 0 [pid 5847] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5843] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5837] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5833] newfstatat(4, "", [pid 5831] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5847] <... futex resumed>) = 1 [pid 5843] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5837] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5834] <... futex resumed>) = 0 [pid 5847] futex(0x7f47695046d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5837] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} ) = ? [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] getdents64(4, [ 96.625629][ T5843] exFAT-fs (loop3): Filesystem has been set read-only [ 96.636089][ T5839] exFAT-fs (loop0): Filesystem has been set read-only [pid 5831] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5843] +++ killed by SIGSEGV +++ [pid 5837] +++ killed by SIGSEGV +++ [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5839] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5833] getdents64(4, [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5837, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- ./strace-static-x86_64: Process 5849 attached [pid 5839] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5833] close(4 [pid 5832] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] unlink("./0/binderfs" [pid 5833] <... close resumed>) = 0 [pid 5831] <... unlink resumed>) = 0 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5849 [pid 5833] rmdir("./0/file1" [pid 5831] getdents64(3, [pid 5833] <... rmdir resumed>) = 0 [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] close(3) = 0 [pid 5831] rmdir("./0") = 0 [pid 5847] <... futex resumed>) = ? [pid 5833] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5839] +++ killed by SIGSEGV +++ [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] mkdir("./1", 0777 [pid 5833] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5831] <... mkdir resumed>) = 0 [pid 5849] set_robust_list(0x5555612166a0, 24 [pid 5847] +++ killed by SIGSEGV +++ [pid 5834] +++ killed by SIGSEGV +++ [pid 5833] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] <... openat resumed>) = 3 [pid 5849] <... set_robust_list resumed>) = 0 [pid 5832] newfstatat(3, "", [pid 5833] unlink("./0/binderfs" [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5849] chdir("./1" [pid 5833] <... unlink resumed>) = 0 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] <... openat resumed>) = 3 [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5834, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=8 /* 0.08 s */} --- [pid 5849] <... chdir resumed>) = 0 [pid 5849] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5832] getdents64(3, [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5829] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5849] <... prctl resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5849] setpgid(0, 0 [pid 5833] getdents64(3, [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5831] <... ioctl resumed>) = 0 [pid 5829] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5849] <... setpgid resumed>) = 0 [pid 5833] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] close(3 [pid 5833] close(3 [pid 5831] <... close resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] <... openat resumed>) = 3 [pid 5849] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5833] rmdir("./0" [pid 5849] <... openat resumed>) = 3 [pid 5833] <... rmdir resumed>) = 0 [pid 5829] newfstatat(3, "", ./strace-static-x86_64: Process 5851 attached [pid 5849] write(3, "1000", 4 [pid 5851] set_robust_list(0x5555612166a0, 24 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5851 [pid 5851] <... set_robust_list resumed>) = 0 [pid 5851] chdir("./1") = 0 [pid 5849] <... write resumed>) = 4 [pid 5833] mkdir("./1", 0777 [pid 5832] <... umount2 resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5849] close(3 [pid 5829] getdents64(3, [pid 5849] <... close resumed>) = 0 [pid 5849] symlink("/dev/binderfs", "./binderfs" [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5849] <... symlink resumed>) = 0 [pid 5833] <... mkdir resumed>) = 0 [pid 5829] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5849] write(1, "executing program\n", 18executing program ) = 18 [pid 5851] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5851] setpgid(0, 0 [pid 5849] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5849] <... futex resumed>) = 0 [pid 5851] <... setpgid resumed>) = 0 [pid 5849] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5849] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5849] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5833] <... openat resumed>) = 3 [pid 5851] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5833] ioctl(3, LOOP_CLR_FD) = 0 [pid 5833] close(3 [pid 5851] <... openat resumed>) = 3 [pid 5833] <... close resumed>) = 0 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5849] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5849] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 5832] newfstatat(AT_FDCWD, "./0/file1", ./strace-static-x86_64: Process 5852 attached [pid 5851] write(3, "1000", 4 [pid 5849] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5851] <... write resumed>) = 4 [pid 5851] close(3) = 0 [pid 5851] symlink("/dev/binderfs", "./binderfs" [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5852 [pid 5852] set_robust_list(0x5555612166a0, 24 [pid 5851] <... symlink resumed>) = 0 [pid 5852] <... set_robust_list resumed>) = 0 [pid 5852] chdir("./1" [pid 5851] write(1, "executing program\n", 18executing program [pid 5852] <... chdir resumed>) = 0 [pid 5851] <... write resumed>) = 18 [pid 5851] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5852] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5851] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5852] setpgid(0, 0 [pid 5849] <... mprotect resumed>) = 0 [pid 5832] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... umount2 resumed>) = 0 [pid 5852] <... setpgid resumed>) = 0 [pid 5851] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5852] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5849] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] <... openat resumed>) = 4 [pid 5852] <... openat resumed>) = 3 [pid 5851] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5849] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] newfstatat(4, "", [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5851] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5849] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5829] newfstatat(AT_FDCWD, "./0/file1", [pid 5852] write(3, "1000", 4 [pid 5851] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5853 attached [pid 5852] <... write resumed>) = 4 [pid 5851] <... mmap resumed>) = 0x7f476940f000 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5853] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5852] close(3 [pid 5851] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5849] <... clone3 resumed> => {parent_tid=[5853]}, 88) = 5853 [pid 5832] getdents64(4, [pid 5853] <... rseq resumed>) = 0 [pid 5829] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5853] set_robust_list(0x7f476942f9a0, 24 [pid 5851] <... mprotect resumed>) = 0 [pid 5849] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5853] <... set_robust_list resumed>) = 0 [pid 5849] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] getdents64(4, [pid 5829] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5853] rt_sigprocmask(SIG_SETMASK, [], [pid 5849] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5853] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5851] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5849] <... futex resumed>) = 0 [pid 5832] close(4 [pid 5829] <... openat resumed>) = 4 [pid 5853] memfd_create("syzkaller", 0 [pid 5852] <... close resumed>) = 0 [pid 5851] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5849] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5832] <... close resumed>) = 0 [pid 5829] newfstatat(4, "", [pid 5852] symlink("/dev/binderfs", "./binderfs" [pid 5851] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5832] rmdir("./0/file1" [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 5854 attached [pid 5853] <... memfd_create resumed>) = 3 [pid 5852] <... symlink resumed>) = 0 executing program [pid 5854] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5853] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5852] write(1, "executing program\n", 18 [pid 5851] <... clone3 resumed> => {parent_tid=[5854]}, 88) = 5854 [pid 5832] <... rmdir resumed>) = 0 [pid 5829] getdents64(4, [pid 5853] <... mmap resumed>) = 0x7f4761000000 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5852] <... write resumed>) = 18 [pid 5851] rt_sigprocmask(SIG_SETMASK, [], [pid 5829] getdents64(4, [pid 5852] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5851] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5853] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5852] <... futex resumed>) = 0 [pid 5851] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5854] <... rseq resumed>) = 0 [pid 5832] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5852] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5851] <... futex resumed>) = 0 [pid 5852] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5851] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5852] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5852] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5854] set_robust_list(0x7f476942f9a0, 24 [pid 5853] <... write resumed>) = 131072 [pid 5852] <... mmap resumed>) = 0x7f476940f000 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] close(4 [pid 5854] <... set_robust_list resumed>) = 0 [pid 5832] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5854] rt_sigprocmask(SIG_SETMASK, [], [pid 5853] munmap(0x7f4761000000, 138412032 [pid 5829] <... close resumed>) = 0 [pid 5854] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5854] memfd_create("syzkaller", 0 [pid 5853] <... munmap resumed>) = 0 [pid 5852] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5832] unlink("./0/binderfs" [pid 5829] rmdir("./0/file1" [pid 5854] <... memfd_create resumed>) = 3 [pid 5853] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5852] <... mprotect resumed>) = 0 [pid 5832] <... unlink resumed>) = 0 [pid 5854] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5852] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5829] <... rmdir resumed>) = 0 [pid 5853] <... openat resumed>) = 4 [pid 5852] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5852] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 5855 attached [pid 5854] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5853] ioctl(4, LOOP_SET_FD, 3 [pid 5852] <... clone3 resumed> => {parent_tid=[5855]}, 88) = 5855 [pid 5832] getdents64(3, [pid 5829] umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5855] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5854] <... write resumed>) = 131072 [pid 5852] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5852] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5852] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5852] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5855] <... rseq resumed>) = 0 [pid 5855] set_robust_list(0x7f476942f9a0, 24) = 0 [pid 5855] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5855] memfd_create("syzkaller", 0 [pid 5832] close(3 [pid 5829] newfstatat(AT_FDCWD, "./0/binderfs", [pid 5855] <... memfd_create resumed>) = 3 [pid 5855] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5832] <... close resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5855] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5854] munmap(0x7f4761000000, 138412032 [pid 5832] rmdir("./0" [pid 5829] unlink("./0/binderfs" [pid 5854] <... munmap resumed>) = 0 [pid 5832] <... rmdir resumed>) = 0 [pid 5829] <... unlink resumed>) = 0 [pid 5855] <... write resumed>) = 131072 [pid 5832] mkdir("./1", 0777 [pid 5829] getdents64(3, [pid 5854] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5855] munmap(0x7f4761000000, 138412032 [pid 5854] <... openat resumed>) = 4 [pid 5855] <... munmap resumed>) = 0 [pid 5854] ioctl(4, LOOP_SET_FD, 3 [pid 5832] <... mkdir resumed>) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5855] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5829] close(3 [pid 5854] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5855] <... openat resumed>) = 4 [pid 5854] ioctl(4, LOOP_CLR_FD [pid 5829] <... close resumed>) = 0 [pid 5854] <... ioctl resumed>) = 0 [pid 5829] rmdir("./0" [pid 5855] ioctl(4, LOOP_SET_FD, 3 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5829] <... rmdir resumed>) = 0 [pid 5832] <... openat resumed>) = 3 [pid 5829] mkdir("./1", 0777 [pid 5853] <... ioctl resumed>) = 0 [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5829] <... mkdir resumed>) = 0 [pid 5854] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 5832] <... ioctl resumed>) = 0 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5854] close(4 [pid 5853] close(3 [pid 5832] close(3 [pid 5854] <... close resumed>) = 0 [pid 5832] <... close resumed>) = 0 [pid 5854] close(3 [pid 5853] <... close resumed>) = 0 [pid 5853] close(4 [pid 5854] <... close resumed>) = 0 [pid 5854] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5853] <... close resumed>) = 0 [pid 5854] <... futex resumed>) = 1 [pid 5853] mkdir("./file1", 0777 [pid 5851] <... futex resumed>) = 0 [pid 5851] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 96.865172][ T5853] loop1: detected capacity change from 0 to 256 [ 96.904879][ T5855] loop4: detected capacity change from 0 to 256 [pid 5855] <... ioctl resumed>) = 0 [pid 5854] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5853] <... mkdir resumed>) = 0 [pid 5851] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] <... openat resumed>) = 3 [pid 5854] <... openat resumed>) = 3 [pid 5853] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 5829] ioctl(3, LOOP_CLR_FD [pid 5855] close(3 [pid 5854] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5855] <... close resumed>) = 0 [pid 5854] <... futex resumed>) = 1 [pid 5855] close(4) = 0 [pid 5855] mkdir("./file1", 0777) = 0 [pid 5855] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5854] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 5856 attached [pid 5851] <... futex resumed>) = 0 [pid 5829] <... ioctl resumed>) = 0 [pid 5851] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5856] set_robust_list(0x5555612166a0, 24 [pid 5854] <... futex resumed>) = 0 [pid 5851] <... futex resumed>) = 1 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5856 [pid 5829] close(3 [pid 5854] mkdir("./file2", 0777 [pid 5851] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5854] <... mkdir resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 5854] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5851] <... futex resumed>) = ? ./strace-static-x86_64: Process 5857 attached [pid 5854] +++ killed by SIGSEGV +++ [pid 5856] <... set_robust_list resumed>) = 0 [pid 5853] <... mount resumed>) = 0 [pid 5851] +++ killed by SIGSEGV +++ [pid 5853] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5851, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=0} --- [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5857 [pid 5857] set_robust_list(0x5555612166a0, 24 [pid 5856] chdir("./1" [pid 5853] <... openat resumed>) = 3 [pid 5831] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 96.969214][ T5853] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5831] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5831] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5857] <... set_robust_list resumed>) = 0 [pid 5856] <... chdir resumed>) = 0 [pid 5853] chdir("./file1" [pid 5831] <... openat resumed>) = 3 [pid 5857] chdir("./1" [pid 5856] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5853] <... chdir resumed>) = 0 [pid 5831] newfstatat(3, "", [pid 5856] <... prctl resumed>) = 0 [pid 5853] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5857] <... chdir resumed>) = 0 [pid 5856] setpgid(0, 0 [pid 5853] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5857] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5856] <... setpgid resumed>) = 0 [pid 5853] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5857] <... prctl resumed>) = 0 [pid 5856] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5853] <... futex resumed>) = 1 [pid 5849] <... futex resumed>) = 0 [pid 5831] getdents64(3, [pid 5857] setpgid(0, 0 [pid 5856] <... openat resumed>) = 3 [pid 5853] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5849] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... getdents64 resumed>0x555561217730 /* 5 entries */, 32768) = 144 [pid 5857] <... setpgid resumed>) = 0 [pid 5856] write(3, "1000", 4 [pid 5853] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5849] <... futex resumed>) = 0 [pid 5857] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5856] <... write resumed>) = 4 [pid 5853] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5849] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] umount2("./1/devices.list", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5857] <... openat resumed>) = 3 [pid 5856] close(3 [pid 5853] <... openat resumed>) = 4 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5857] write(3, "1000", 4 [pid 5856] <... close resumed>) = 0 [pid 5831] newfstatat(AT_FDCWD, "./1/devices.list", [pid 5857] <... write resumed>) = 4 [pid 5856] symlink("/dev/binderfs", "./binderfs" [pid 5857] close(3 [pid 5856] <... symlink resumed>) = 0 [pid 5853] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5857] <... close resumed>) = 0 executing program [pid 5856] write(1, "executing program\n", 18 [pid 5853] <... futex resumed>) = 1 [pid 5849] <... futex resumed>) = 0 [pid 5855] <... mount resumed>) = 0 [pid 5831] unlink("./1/devices.list" [pid 5857] symlink("/dev/binderfs", "./binderfs" [pid 5856] <... write resumed>) = 18 executing program [pid 5855] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5853] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5849] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5856] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5857] <... symlink resumed>) = 0 [pid 5856] <... futex resumed>) = 0 [pid 5855] <... openat resumed>) = 3 [pid 5853] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5849] <... futex resumed>) = 0 [pid 5831] <... unlink resumed>) = 0 [pid 5857] write(1, "executing program\n", 18 [pid 5856] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5855] chdir("./file1" [pid 5853] mkdir("./file2", 0777 [pid 5849] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5857] <... write resumed>) = 18 [pid 5856] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5831] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5857] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5856] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5857] <... futex resumed>) = 0 [pid 5856] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] newfstatat(AT_FDCWD, "./1/binderfs", [ 97.026891][ T5855] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5857] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5856] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5857] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5856] <... mmap resumed>) = 0x7f476940f000 [pid 5831] unlink("./1/binderfs" [pid 5857] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5856] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5857] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5856] <... mprotect resumed>) = 0 [pid 5857] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 5857] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5856] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5855] <... chdir resumed>) = 0 [pid 5831] <... unlink resumed>) = 0 [pid 5857] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5831] umount2("./1/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5857] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5857] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5856] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5831] newfstatat(AT_FDCWD, "./1/file2", [pid 5856] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 5858 attached [pid 5855] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5858] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5856] <... clone3 resumed> => {parent_tid=[5858]}, 88) = 5858 [pid 5831] umount2("./1/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5858] <... rseq resumed>) = 0 [pid 5857] <... clone3 resumed> => {parent_tid=[5859]}, 88) = 5859 [pid 5856] rt_sigprocmask(SIG_SETMASK, [], [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5858] set_robust_list(0x7f476942f9a0, 24 [pid 5857] rt_sigprocmask(SIG_SETMASK, [], [pid 5856] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5859 attached [pid 5858] <... set_robust_list resumed>) = 0 [pid 5855] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5856] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5855] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [ 97.087667][ T5853] exFAT-fs (loop1): error, data size is invalid(9000) [pid 5831] openat(AT_FDCWD, "./1/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5859] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5858] rt_sigprocmask(SIG_SETMASK, [], [pid 5857] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5856] <... futex resumed>) = 0 [pid 5855] <... futex resumed>) = 1 [pid 5852] <... futex resumed>) = 0 [pid 5849] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5831] <... openat resumed>) = 4 [pid 5831] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] getdents64(4, [pid 5858] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5857] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5856] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5858] memfd_create("syzkaller", 0 [pid 5857] <... futex resumed>) = 0 [pid 5831] getdents64(4, [pid 5858] <... memfd_create resumed>) = 3 [pid 5857] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5855] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5859] <... rseq resumed>) = 0 [pid 5852] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5849] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5855] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5859] set_robust_list(0x7f476942f9a0, 24 [pid 5858] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5855] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5853] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5852] <... futex resumed>) = 0 [pid 5849] <... futex resumed>) = 0 [pid 5831] close(4 [pid 5859] <... set_robust_list resumed>) = 0 [pid 5849] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5859] rt_sigprocmask(SIG_SETMASK, [], [pid 5852] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5859] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5849] <... mmap resumed>) = 0x7f47693ee000 [pid 5859] memfd_create("syzkaller", 0 [pid 5858] <... mmap resumed>) = 0x7f4761000000 [pid 5853] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5849] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5831] <... close resumed>) = 0 [pid 5859] <... memfd_create resumed>) = 3 [pid 5858] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5855] <... openat resumed>) = 4 [pid 5849] <... mprotect resumed>) = ? [pid 5831] rmdir("./1/file2" [pid 5859] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5855] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5853] +++ killed by SIGSEGV +++ [pid 5849] +++ killed by SIGSEGV +++ [pid 5831] <... rmdir resumed>) = 0 [pid 5859] <... mmap resumed>) = 0x7f4761000000 [pid 5855] <... futex resumed>) = 1 [pid 5852] <... futex resumed>) = 0 [pid 5859] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5858] <... write resumed>) = 131072 [pid 5855] mkdir("./file2", 0777 [pid 5852] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] getdents64(3, [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5849, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=6 /* 0.06 s */} --- [ 97.132800][ T5853] exFAT-fs (loop1): Filesystem has been set read-only [pid 5858] munmap(0x7f4761000000, 138412032 [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5858] <... munmap resumed>) = 0 [pid 5831] close(3 [pid 5858] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5831] <... close resumed>) = 0 [pid 5859] <... write resumed>) = 131072 [pid 5858] <... openat resumed>) = 4 [pid 5852] <... futex resumed>) = 0 [pid 5831] rmdir("./1" [pid 5830] restart_syscall(<... resuming interrupted clone ...> [pid 5859] munmap(0x7f4761000000, 138412032 [pid 5858] ioctl(4, LOOP_SET_FD, 3 [pid 5859] <... munmap resumed>) = 0 [pid 5852] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... rmdir resumed>) = 0 [pid 5830] <... restart_syscall resumed>) = 0 [pid 5859] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5831] mkdir("./2", 0777 [pid 5859] <... openat resumed>) = 4 [pid 5831] <... mkdir resumed>) = 0 [pid 5859] ioctl(4, LOOP_SET_FD, 3 [pid 5830] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 5831] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 5831] close(3) = 0 [ 97.181114][ T5855] exFAT-fs (loop4): error, data size is invalid(9000) [ 97.205782][ T5858] loop3: detected capacity change from 0 to 256 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 ./strace-static-x86_64: Process 5860 attached [pid 5858] <... ioctl resumed>) = 0 [pid 5830] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] getdents64(3, [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5860 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5860] set_robust_list(0x5555612166a0, 24 [pid 5858] close(3 [pid 5860] <... set_robust_list resumed>) = 0 [pid 5858] <... close resumed>) = 0 [pid 5860] chdir("./2" [pid 5858] close(4 [pid 5860] <... chdir resumed>) = 0 [pid 5858] <... close resumed>) = 0 [pid 5860] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5858] mkdir("./file1", 0777 [pid 5860] <... prctl resumed>) = 0 [pid 5858] <... mkdir resumed>) = 0 [pid 5860] setpgid(0, 0) = 0 [pid 5830] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5860] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5852] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5852] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5860] write(3, "1000", 4) = 4 [pid 5858] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5852] <... futex resumed>) = 0 [pid 5860] close(3 [pid 5859] <... ioctl resumed>) = 0 [pid 5852] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5860] <... close resumed>) = 0 [pid 5860] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5859] close(3 [pid 5852] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5860] write(1, "executing program\n", 18 [pid 5859] <... close resumed>) = 0 [pid 5852] <... mprotect resumed>) = 0 [pid 5859] close(4executing program [pid 5860] <... write resumed>) = 18 [pid 5859] <... close resumed>) = 0 [pid 5855] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5852] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5860] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5852] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5859] mkdir("./file1", 0777 [pid 5852] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5860] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5861 attached [pid 5859] <... mkdir resumed>) = 0 [pid 5852] <... clone3 resumed> => {parent_tid=[5861]}, 88) = 5861 [ 97.225486][ T5859] loop0: detected capacity change from 0 to 256 [ 97.236863][ T5855] exFAT-fs (loop4): Filesystem has been set read-only [pid 5861] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5860] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5852] rt_sigprocmask(SIG_SETMASK, [], [pid 5861] <... rseq resumed>) = 0 [pid 5859] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5855] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5860] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5860] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5860] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5861] ???( [pid 5852] <... rt_sigprocmask resumed>) = ? [pid 5861] <... ??? resumed>) = ? [pid 5860] <... mmap resumed>) = 0x7f476940f000 [pid 5860] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5861] +++ killed by SIGSEGV +++ [pid 5860] <... mprotect resumed>) = 0 [pid 5860] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5860] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 5862 attached [pid 5855] +++ killed by SIGSEGV +++ [pid 5852] +++ killed by SIGSEGV +++ [pid 5860] <... clone3 resumed> => {parent_tid=[5862]}, 88) = 5862 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5852, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5830] <... umount2 resumed>) = 0 [pid 5862] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5860] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5862] <... rseq resumed>) = 0 [pid 5860] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] newfstatat(AT_FDCWD, "./1/file1", [pid 5862] set_robust_list(0x7f476942f9a0, 24 [pid 5860] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... openat resumed>) = 3 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5862] <... set_robust_list resumed>) = 0 [pid 5860] <... futex resumed>) = 0 [pid 5862] rt_sigprocmask(SIG_SETMASK, [], [pid 5860] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5862] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] newfstatat(3, "", [pid 5830] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5862] memfd_create("syzkaller", 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5862] <... memfd_create resumed>) = 3 [pid 5833] getdents64(3, [pid 5830] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5862] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] <... openat resumed>) = 4 [pid 5862] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5833] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] getdents64(4, [pid 5862] <... write resumed>) = 131072 [pid 5862] munmap(0x7f4761000000, 138412032 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5833] <... umount2 resumed>) = 0 [pid 5830] close(4) = 0 [pid 5862] <... munmap resumed>) = 0 [pid 5833] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] rmdir("./1/file1" [pid 5862] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 5830] <... rmdir resumed>) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 97.338641][ T5859] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 97.370638][ T5862] loop2: detected capacity change from 0 to 256 [pid 5862] ioctl(4, LOOP_SET_FD, 3 [pid 5830] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] newfstatat(AT_FDCWD, "./1/file1", [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5859] <... mount resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5862] <... ioctl resumed>) = 0 [pid 5862] close(3) = 0 [pid 5862] close(4) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] unlink("./1/binderfs" [pid 5862] mkdir("./file1", 0777) = 0 [pid 5862] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5830] <... unlink resumed>) = 0 [pid 5833] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] getdents64(3, [pid 5833] <... openat resumed>) = 4 [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5858] <... mount resumed>) = 0 [pid 5833] newfstatat(4, "", [pid 5830] close(3 [pid 5859] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5859] <... openat resumed>) = 3 [pid 5858] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5833] getdents64(4, [pid 5830] <... close resumed>) = 0 [pid 5859] chdir("./file1" [pid 5858] <... openat resumed>) = 3 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5858] chdir("./file1") = 0 [pid 5833] getdents64(4, [pid 5830] rmdir("./1" [pid 5859] <... chdir resumed>) = 0 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5858] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5830] <... rmdir resumed>) = 0 [pid 5833] close(4 [pid 5859] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5830] mkdir("./2", 0777 [pid 5859] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5858] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... close resumed>) = 0 [pid 5858] <... futex resumed>) = 1 [pid 5856] <... futex resumed>) = 0 [pid 5856] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5859] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5856] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] rmdir("./1/file1" [pid 5830] <... mkdir resumed>) = 0 [pid 5859] <... futex resumed>) = 1 [pid 5858] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5857] <... futex resumed>) = 0 [pid 5859] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5858] <... openat resumed>) = 4 [pid 5857] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... rmdir resumed>) = 0 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5859] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5857] <... futex resumed>) = 0 [pid 5833] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... openat resumed>) = 3 [pid 5859] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5858] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [ 97.378775][ T5858] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5857] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5858] <... futex resumed>) = 1 [pid 5856] <... futex resumed>) = 0 [pid 5859] <... openat resumed>) = 4 [pid 5858] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5856] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] newfstatat(AT_FDCWD, "./1/binderfs", [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5858] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5856] <... futex resumed>) = 0 [pid 5858] mkdir("./file2", 0777 [pid 5856] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5859] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] <... ioctl resumed>) = 0 [pid 5859] <... futex resumed>) = 1 [pid 5833] unlink("./1/binderfs" [pid 5830] close(3 [pid 5859] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5833] <... unlink resumed>) = 0 [pid 5857] <... futex resumed>) = 0 [pid 5833] getdents64(3, [pid 5830] <... close resumed>) = 0 [pid 5857] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5857] <... futex resumed>) = 1 [pid 5833] close(3 [ 97.450317][ T5862] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 97.468893][ T5858] exFAT-fs (loop3): error, data size is invalid(9000) [pid 5857] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5859] <... futex resumed>) = 0 [pid 5856] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5833] <... close resumed>) = 0 [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5859] mkdir("./file2", 0777 [pid 5833] rmdir("./1" [pid 5856] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5856] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5862] <... mount resumed>) = 0 [pid 5856] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5833] <... rmdir resumed>) = 0 [pid 5862] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5856] <... mprotect resumed>) = 0 [pid 5862] <... openat resumed>) = 3 [pid 5856] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5862] chdir("./file1" [pid 5856] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5862] <... chdir resumed>) = 0 [pid 5856] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0}./strace-static-x86_64: Process 5864 attached [pid 5862] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5856] <... clone3 resumed> => {parent_tid=[5864]}, 88) = 5864 [pid 5862] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5856] rt_sigprocmask(SIG_SETMASK, [], [pid 5862] <... futex resumed>) = 1 [pid 5860] <... futex resumed>) = 0 [pid 5856] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] mkdir("./2", 0777 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5863 ./strace-static-x86_64: Process 5863 attached [pid 5864] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5862] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5860] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5856] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5864] <... rseq resumed>) = 0 [pid 5862] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5860] <... futex resumed>) = 0 [pid 5856] <... futex resumed>) = 0 [pid 5864] set_robust_list(0x7f476940e9a0, 24 [pid 5863] set_robust_list(0x5555612166a0, 24 [pid 5862] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5860] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5856] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... mkdir resumed>) = 0 [pid 5864] <... set_robust_list resumed>) = 0 [pid 5864] rt_sigprocmask(SIG_SETMASK, [], [pid 5863] <... set_robust_list resumed>) = 0 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5864] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5864] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5863] chdir("./2" [pid 5857] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5864] <... ioctl resumed>) = 0 [pid 5862] <... openat resumed>) = 4 [pid 5858] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5863] <... chdir resumed>) = 0 [pid 5833] <... openat resumed>) = 3 [pid 5864] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5862] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5858] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5857] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5862] <... futex resumed>) = 1 [ 97.500279][ T5858] exFAT-fs (loop3): Filesystem has been set read-only [ 97.521958][ T5859] exFAT-fs (loop0): error, data size is invalid(9000) [pid 5860] <... futex resumed>) = 0 [pid 5857] <... futex resumed>) = 0 [pid 5864] <... futex resumed>) = ? [pid 5863] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5862] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5860] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5857] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5856] <... futex resumed>) = ? [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5864] +++ killed by SIGSEGV +++ [pid 5862] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5860] <... futex resumed>) = 0 [pid 5857] <... mmap resumed>) = 0x7f47693ee000 [pid 5863] <... prctl resumed>) = 0 [pid 5862] mkdir("./file2", 0777 [pid 5860] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5858] +++ killed by SIGSEGV +++ [pid 5857] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5856] +++ killed by SIGSEGV +++ [pid 5833] <... ioctl resumed>) = 0 [pid 5863] setpgid(0, 0 [pid 5859] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5863] <... setpgid resumed>) = 0 [pid 5859] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5857] <... mprotect resumed>) = 0 [pid 5833] close(3 [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5856, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5863] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5859] +++ killed by SIGSEGV +++ [pid 5857] +++ killed by SIGSEGV +++ [pid 5832] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] <... close resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5857, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5863] <... openat resumed>) = 3 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5832] <... openat resumed>) = 3 [pid 5829] restart_syscall(<... resuming interrupted clone ...> [pid 5832] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 5832] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5865 attached [pid 5863] write(3, "1000", 4 [pid 5829] <... restart_syscall resumed>) = 0 [ 97.558069][ T5859] exFAT-fs (loop0): Filesystem has been set read-only [ 97.573850][ T5862] exFAT-fs (loop2): error, data size is invalid(9000) [pid 5865] set_robust_list(0x5555612166a0, 24 [pid 5863] <... write resumed>) = 4 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5865 [pid 5832] <... umount2 resumed>) = 0 [pid 5865] <... set_robust_list resumed>) = 0 [pid 5863] close(3 [pid 5832] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5863] <... close resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5863] symlink("/dev/binderfs", "./binderfs" [pid 5832] newfstatat(AT_FDCWD, "./1/file1", executing program [pid 5863] <... symlink resumed>) = 0 [pid 5829] umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5863] write(1, "executing program\n", 18 [pid 5832] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5863] <... write resumed>) = 18 [pid 5865] chdir("./2" [pid 5863] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... openat resumed>) = 4 [pid 5829] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5863] <... futex resumed>) = 0 [pid 5865] <... chdir resumed>) = 0 [pid 5863] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5832] newfstatat(4, "", [pid 5829] <... openat resumed>) = 3 [pid 5865] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5863] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5860] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] newfstatat(3, "", [pid 5863] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5832] getdents64(4, [pid 5863] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5863] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5860] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5863] <... mmap resumed>) = 0x7f476940f000 [pid 5865] <... prctl resumed>) = 0 [pid 5863] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5860] <... futex resumed>) = 0 [pid 5832] getdents64(4, [pid 5829] getdents64(3, [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5865] setpgid(0, 0 [pid 5863] <... mprotect resumed>) = 0 [pid 5860] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5832] close(4 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5865] <... setpgid resumed>) = 0 [pid 5860] <... mmap resumed>) = 0x7f47693ee000 [pid 5829] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5865] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5860] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5832] <... close resumed>) = 0 [pid 5865] <... openat resumed>) = 3 [pid 5863] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5860] <... mprotect resumed>) = 0 [pid 5832] rmdir("./1/file1" [pid 5863] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5865] write(3, "1000", 4 [pid 5863] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5860] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] <... rmdir resumed>) = 0 [pid 5865] <... write resumed>) = 4 [pid 5860] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5866 attached [pid 5865] close(3 [pid 5860] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./1/binderfs", ./strace-static-x86_64: Process 5867 attached [pid 5865] <... close resumed>) = 0 [pid 5867] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5866] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5865] symlink("/dev/binderfs", "./binderfs" [pid 5863] <... clone3 resumed> => {parent_tid=[5866]}, 88) = 5866 [pid 5860] <... clone3 resumed> => {parent_tid=[5867]}, 88) = 5867 [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] <... umount2 resumed>) = 0 executing program [pid 5867] <... rseq resumed>) = 0 [pid 5866] <... rseq resumed>) = 0 [pid 5865] <... symlink resumed>) = 0 [pid 5863] rt_sigprocmask(SIG_SETMASK, [], [pid 5860] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] unlink("./1/binderfs" [pid 5829] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5867] set_robust_list(0x7f476940e9a0, 24 [pid 5865] write(1, "executing program\n", 18 [pid 5860] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5867] <... set_robust_list resumed>) = 0 [pid 5865] <... write resumed>) = 18 [pid 5860] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5867] rt_sigprocmask(SIG_SETMASK, [], [pid 5865] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5860] <... futex resumed>) = 0 [pid 5867] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5866] set_robust_list(0x7f476942f9a0, 24 [pid 5865] <... futex resumed>) = 0 [pid 5863] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5862] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5860] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] <... unlink resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5867] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5866] <... set_robust_list resumed>) = 0 [pid 5865] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5863] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5862] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 97.638134][ T5862] exFAT-fs (loop2): Filesystem has been set read-only [pid 5832] getdents64(3, [pid 5866] rt_sigprocmask(SIG_SETMASK, [], [pid 5863] <... futex resumed>) = 0 [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] newfstatat(AT_FDCWD, "./1/file1", [pid 5866] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5865] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5832] close(3 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] <... close resumed>) = 0 [pid 5867] <... ioctl resumed>) = ? [pid 5865] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5860] <... futex resumed>) = ? [pid 5867] +++ killed by SIGSEGV +++ [pid 5866] memfd_create("syzkaller", 0 [pid 5865] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5863] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5832] rmdir("./1" [pid 5829] umount2("./1/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5865] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 5865] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5866] <... memfd_create resumed>) = 3 [pid 5865] <... mprotect resumed>) = 0 [pid 5832] <... rmdir resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5866] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5865] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] mkdir("./2", 0777 [pid 5829] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5866] <... mmap resumed>) = 0x7f4761000000 [pid 5866] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5865] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] <... mkdir resumed>) = 0 [pid 5829] <... openat resumed>) = 4 [pid 5829] newfstatat(4, "", [pid 5865] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 5868 attached [pid 5866] <... write resumed>) = 131072 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5868] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5865] <... clone3 resumed> => {parent_tid=[5868]}, 88) = 5868 [pid 5829] getdents64(4, [pid 5868] <... rseq resumed>) = 0 [pid 5865] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... openat resumed>) = 3 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5868] set_robust_list(0x7f476942f9a0, 24 [pid 5865] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5862] +++ killed by SIGSEGV +++ [pid 5860] +++ killed by SIGSEGV +++ [pid 5868] <... set_robust_list resumed>) = 0 [pid 5865] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5868] rt_sigprocmask(SIG_SETMASK, [], [pid 5865] <... futex resumed>) = 0 [pid 5868] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5860, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5868] memfd_create("syzkaller", 0 [pid 5866] munmap(0x7f4761000000, 138412032 [pid 5865] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5829] getdents64(4, [pid 5868] <... memfd_create resumed>) = 3 [pid 5866] <... munmap resumed>) = 0 [pid 5831] restart_syscall(<... resuming interrupted clone ...> [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5868] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5866] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5831] <... restart_syscall resumed>) = 0 [pid 5829] close(4 [pid 5868] <... mmap resumed>) = 0x7f4761000000 [pid 5868] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5866] <... openat resumed>) = 4 [pid 5832] <... ioctl resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 5831] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5831] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5868] <... write resumed>) = 131072 [pid 5831] newfstatat(3, "", [pid 5866] ioctl(4, LOOP_SET_FD, 3 [pid 5832] close(3 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] rmdir("./1/file1" [pid 5868] munmap(0x7f4761000000, 138412032 [pid 5831] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 5868] <... munmap resumed>) = 0 [pid 5831] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... rmdir resumed>) = 0 [pid 5868] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5866] <... ioctl resumed>) = 0 [pid 5832] <... close resumed>) = 0 [pid 5829] umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5868] <... openat resumed>) = 4 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5868] ioctl(4, LOOP_SET_FD, 3 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5866] close(3 [pid 5831] <... umount2 resumed>) = 0 [pid 5829] newfstatat(AT_FDCWD, "./1/binderfs", [pid 5831] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5866] <... close resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] newfstatat(AT_FDCWD, "./2/file1", [pid 5829] unlink("./1/binderfs" [pid 5866] close(4 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5866] <... close resumed>) = 0 [pid 5866] mkdir("./file1", 0777) = 0 [pid 5831] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... unlink resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] getdents64(3, [pid 5831] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] <... openat resumed>) = 4 [pid 5829] close(3 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5869 [pid 5831] newfstatat(4, "", [pid 5829] <... close resumed>) = 0 ./strace-static-x86_64: Process 5869 attached [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] rmdir("./1" [pid 5866] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 5869] set_robust_list(0x5555612166a0, 24 [pid 5831] getdents64(4, [pid 5829] <... rmdir resumed>) = 0 [pid 5869] <... set_robust_list resumed>) = 0 [pid 5829] mkdir("./2", 0777 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5869] chdir("./2" [pid 5868] <... ioctl resumed>) = 0 [pid 5831] getdents64(4, [pid 5829] <... mkdir resumed>) = 0 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5831] close(4 [pid 5869] <... chdir resumed>) = 0 [pid 5829] <... openat resumed>) = 3 [pid 5831] <... close resumed>) = 0 [pid 5829] ioctl(3, LOOP_CLR_FD [pid 5869] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5831] rmdir("./2/file1" [pid 5869] <... prctl resumed>) = 0 [pid 5829] <... ioctl resumed>) = 0 [ 97.759985][ T5866] loop1: detected capacity change from 0 to 256 [ 97.781794][ T5868] loop4: detected capacity change from 0 to 256 [pid 5869] setpgid(0, 0 [pid 5868] close(3 [pid 5831] <... rmdir resumed>) = 0 [pid 5829] close(3 [pid 5869] <... setpgid resumed>) = 0 [pid 5868] <... close resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 5868] close(4 [pid 5869] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5868] <... close resumed>) = 0 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5870 attached [pid 5869] <... openat resumed>) = 3 [pid 5868] mkdir("./file1", 0777 [pid 5831] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5870] set_robust_list(0x5555612166a0, 24 [pid 5869] write(3, "1000", 4 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5870] <... set_robust_list resumed>) = 0 [pid 5869] <... write resumed>) = 4 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5870 [pid 5870] chdir("./2" [pid 5869] close(3) = 0 [pid 5870] <... chdir resumed>) = 0 [pid 5869] symlink("/dev/binderfs", "./binderfs" [pid 5831] newfstatat(AT_FDCWD, "./2/binderfs", [pid 5870] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5869] <... symlink resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5870] <... prctl resumed>) = 0 [pid 5831] unlink("./2/binderfs" [pid 5870] setpgid(0, 0 [pid 5831] <... unlink resumed>) = 0 [pid 5868] <... mkdir resumed>) = 0 [pid 5831] getdents64(3, [pid 5870] <... setpgid resumed>) = 0 [pid 5869] write(1, "executing program\n", 18 [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 executing program [pid 5870] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5869] <... write resumed>) = 18 [pid 5868] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5831] close(3 [pid 5870] <... openat resumed>) = 3 [pid 5869] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... close resumed>) = 0 [pid 5869] <... futex resumed>) = 0 [pid 5831] rmdir("./2" [pid 5869] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 5831] <... rmdir resumed>) = 0 [pid 5870] write(3, "1000", 4 [pid 5869] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5831] mkdir("./3", 0777 [pid 5870] <... write resumed>) = 4 [pid 5869] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5870] close(3 [pid 5869] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5831] <... mkdir resumed>) = 0 [pid 5870] <... close resumed>) = 0 [pid 5870] symlink("/dev/binderfs", "./binderfs" [pid 5869] <... mmap resumed>) = 0x7f476940f000 [pid 5870] <... symlink resumed>) = 0 [ 97.850057][ T5866] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5869] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5870] write(1, "executing program\n", 18 [pid 5866] <... mount resumed>) = 0 executing program [pid 5866] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5866] chdir("./file1") = 0 [pid 5866] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5866] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5870] <... write resumed>) = 18 [pid 5866] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5870] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5863] <... futex resumed>) = 0 [pid 5831] <... openat resumed>) = 3 [pid 5869] <... mprotect resumed>) = 0 [pid 5863] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5870] <... futex resumed>) = 0 [pid 5869] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5866] <... futex resumed>) = 0 [pid 5863] <... futex resumed>) = 1 [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5870] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5869] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5863] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... ioctl resumed>) = 0 [pid 5866] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5831] close(3 [pid 5870] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5869] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5870] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], ./strace-static-x86_64: Process 5871 attached NULL, 8) = 0 [pid 5871] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5869] <... clone3 resumed> => {parent_tid=[5871]}, 88) = 5871 [pid 5870] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5871] <... rseq resumed>) = 0 [pid 5870] <... mmap resumed>) = 0x7f476940f000 [pid 5869] rt_sigprocmask(SIG_SETMASK, [], [pid 5866] <... openat resumed>) = 4 [pid 5831] <... close resumed>) = 0 [pid 5871] set_robust_list(0x7f476942f9a0, 24 [pid 5870] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5871] <... set_robust_list resumed>) = 0 [pid 5870] <... mprotect resumed>) = 0 [pid 5869] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5871] rt_sigprocmask(SIG_SETMASK, [], [pid 5869] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5866] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5870] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5866] <... futex resumed>) = 1 [pid 5863] <... futex resumed>) = 0 [pid 5871] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5869] <... futex resumed>) = 0 [pid 5863] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 5872 attached [pid 5871] memfd_create("syzkaller", 0 [pid 5870] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5869] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5866] mkdir("./file2", 0777 [pid 5863] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5871] <... memfd_create resumed>) = 3 [pid 5870] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5872] set_robust_list(0x5555612166a0, 24 [pid 5871] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5872 ./strace-static-x86_64: Process 5873 attached [pid 5872] <... set_robust_list resumed>) = 0 [pid 5872] chdir("./3" [pid 5871] <... mmap resumed>) = 0x7f4761000000 [pid 5870] <... clone3 resumed> => {parent_tid=[5873]}, 88) = 5873 [pid 5872] <... chdir resumed>) = 0 [pid 5870] rt_sigprocmask(SIG_SETMASK, [], [pid 5872] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5873] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053) = 0 [pid 5873] set_robust_list(0x7f476942f9a0, 24 [pid 5872] <... prctl resumed>) = 0 [pid 5873] <... set_robust_list resumed>) = 0 [pid 5873] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5872] setpgid(0, 0 [pid 5873] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5872] <... setpgid resumed>) = 0 [pid 5872] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5871] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5870] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5872] write(3, "1000", 4) = 4 [pid 5872] close(3) = 0 [pid 5872] symlink("/dev/binderfs", "./binderfs"executing program ) = 0 [pid 5870] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5872] write(1, "executing program\n", 18 [pid 5863] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5871] <... write resumed>) = 131072 [pid 5870] <... futex resumed>) = 1 [pid 5870] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5873] <... futex resumed>) = 0 [pid 5872] <... write resumed>) = 18 [pid 5863] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5873] memfd_create("syzkaller", 0 [pid 5872] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5863] <... futex resumed>) = 0 [pid 5873] <... memfd_create resumed>) = 3 [pid 5872] <... futex resumed>) = 0 [pid 5873] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5863] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5873] <... mmap resumed>) = 0x7f4761000000 [ 97.956877][ T5866] exFAT-fs (loop1): error, data size is invalid(9000) [ 97.968140][ T5868] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5872] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5863] <... mmap resumed>) = 0x7f47693ee000 [pid 5873] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5872] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5871] munmap(0x7f4761000000, 138412032 [pid 5872] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5863] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5872] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5863] <... mprotect resumed>) = 0 [pid 5872] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5871] <... munmap resumed>) = 0 [pid 5863] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5873] <... write resumed>) = 131072 [pid 5872] <... mmap resumed>) = 0x7f476940f000 [pid 5863] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5872] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5863] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5872] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 5874 attached [pid 5872] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5871] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5874] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5872] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5863] <... clone3 resumed> => {parent_tid=[5874]}, 88) = 5874 [pid 5874] <... rseq resumed>) = 0 [pid 5872] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5871] <... openat resumed>) = 4 [pid 5863] rt_sigprocmask(SIG_SETMASK, [], [pid 5874] set_robust_list(0x7f476940e9a0, 24 [pid 5873] munmap(0x7f4761000000, 138412032 [pid 5868] <... mount resumed>) = 0 [pid 5871] ioctl(4, LOOP_SET_FD, 3 [pid 5874] <... set_robust_list resumed>) = 0 [pid 5874] rt_sigprocmask(SIG_SETMASK, [], [pid 5872] <... clone3 resumed> => {parent_tid=[5875]}, 88) = 5875 [pid 5863] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5874] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5873] <... munmap resumed>) = 0 [pid 5872] rt_sigprocmask(SIG_SETMASK, [], [pid 5863] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5874] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5872] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5863] <... futex resumed>) = 0 [pid 5872] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5863] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 98.023697][ T5866] exFAT-fs (loop1): Filesystem has been set read-only [ 98.060895][ T5871] loop3: detected capacity change from 0 to 256 [pid 5873] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5872] <... futex resumed>) = 0 [pid 5873] <... openat resumed>) = 4 [pid 5872] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5873] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 5875 attached [pid 5868] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5875] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5874] <... ioctl resumed>) = 0 [pid 5868] <... openat resumed>) = 3 [pid 5866] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5875] <... rseq resumed>) = 0 [pid 5868] chdir("./file1" [pid 5875] set_robust_list(0x7f476942f9a0, 24 [pid 5866] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5875] <... set_robust_list resumed>) = 0 [pid 5868] <... chdir resumed>) = 0 [pid 5875] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5873] <... ioctl resumed>) = 0 [pid 5871] <... ioctl resumed>) = 0 [pid 5868] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5875] memfd_create("syzkaller", 0 [pid 5868] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5868] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5875] <... memfd_create resumed>) = 3 [pid 5868] <... futex resumed>) = 1 [pid 5865] <... futex resumed>) = 0 [pid 5868] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5865] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5863] <... futex resumed>) = ? [pid 5874] +++ killed by SIGSEGV +++ [pid 5865] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5873] close(3 [pid 5875] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5871] close(3 [pid 5868] <... openat resumed>) = 4 [ 98.064316][ T5873] loop0: detected capacity change from 0 to 256 [pid 5875] <... mmap resumed>) = 0x7f4761000000 [pid 5873] <... close resumed>) = 0 [pid 5871] <... close resumed>) = 0 [pid 5868] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5866] +++ killed by SIGSEGV +++ [pid 5863] +++ killed by SIGSEGV +++ [pid 5871] close(4 [pid 5868] <... futex resumed>) = 1 [pid 5865] <... futex resumed>) = 0 [pid 5871] <... close resumed>) = 0 [pid 5868] mkdir("./file2", 0777 [pid 5865] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5863, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5875] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5871] mkdir("./file1", 0777 [pid 5865] <... futex resumed>) = 0 [pid 5865] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] restart_syscall(<... resuming interrupted clone ...> [pid 5875] <... write resumed>) = 131072 [pid 5873] close(4 [pid 5871] <... mkdir resumed>) = 0 [pid 5830] <... restart_syscall resumed>) = 0 [pid 5875] munmap(0x7f4761000000, 138412032 [pid 5873] <... close resumed>) = 0 [pid 5871] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5875] <... munmap resumed>) = 0 [pid 5873] mkdir("./file1", 0777 [pid 5875] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5868] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5830] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5875] <... openat resumed>) = 4 [pid 5830] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5875] ioctl(4, LOOP_SET_FD, 3 [pid 5873] <... mkdir resumed>) = 0 [pid 5830] newfstatat(3, "", [pid 5873] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5868] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] getdents64(3, [pid 5865] <... futex resumed>) = ? [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5868] +++ killed by SIGSEGV +++ [pid 5830] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5875] <... ioctl resumed>) = 0 [pid 5865] +++ killed by SIGSEGV +++ [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5865, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5830] <... umount2 resumed>) = 0 [ 98.122263][ T5868] exFAT-fs (loop4): error, data size is invalid(9000) [ 98.134411][ T5868] exFAT-fs (loop4): Filesystem has been set read-only [ 98.155607][ T5875] loop2: detected capacity change from 0 to 256 [pid 5875] close(3 [pid 5830] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5875] <... close resumed>) = 0 [pid 5833] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5875] close(4 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5875] <... close resumed>) = 0 [pid 5833] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5875] mkdir("./file1", 0777 [pid 5830] newfstatat(AT_FDCWD, "./2/file1", [pid 5833] <... openat resumed>) = 3 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5875] <... mkdir resumed>) = 0 [pid 5833] newfstatat(3, "", [pid 5830] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5875] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5833] getdents64(3, [pid 5830] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] getdents64(4, [pid 5833] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] getdents64(4, [pid 5833] <... umount2 resumed>) = 0 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5833] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] close(4 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... close resumed>) = 0 [pid 5833] newfstatat(AT_FDCWD, "./2/file1", [pid 5830] rmdir("./2/file1") = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [ 98.213139][ T5871] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 98.239614][ T5873] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5830] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5871] <... mount resumed>) = 0 [pid 5873] <... mount resumed>) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5871] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5871] chdir("./file1") = 0 [pid 5871] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5871] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5871] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5873] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5869] <... futex resumed>) = 0 [pid 5833] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] newfstatat(AT_FDCWD, "./2/binderfs", [pid 5875] <... mount resumed>) = 0 [pid 5869] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5875] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5873] <... openat resumed>) = 3 [pid 5871] <... futex resumed>) = 0 [pid 5869] <... futex resumed>) = 1 [pid 5833] <... openat resumed>) = 4 [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5875] <... openat resumed>) = 3 [pid 5873] chdir("./file1" [pid 5871] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5869] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] newfstatat(4, "", [pid 5830] unlink("./2/binderfs" [pid 5875] chdir("./file1" [pid 5873] <... chdir resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5875] <... chdir resumed>) = 0 [pid 5873] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [ 98.297393][ T5875] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5875] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5871] <... openat resumed>) = 4 [pid 5833] getdents64(4, [pid 5830] <... unlink resumed>) = 0 [pid 5875] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5871] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] getdents64(3, [pid 5875] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5873] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5871] <... futex resumed>) = 1 [pid 5869] <... futex resumed>) = 0 [pid 5833] getdents64(4, [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5875] <... futex resumed>) = 1 [pid 5873] <... futex resumed>) = 1 [pid 5872] <... futex resumed>) = 0 [pid 5871] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5870] <... futex resumed>) = 0 [pid 5869] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] close(3 [pid 5875] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5873] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5872] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5871] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5870] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5869] <... futex resumed>) = 0 [pid 5833] close(4 [pid 5830] <... close resumed>) = 0 [pid 5875] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5873] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5872] <... futex resumed>) = 0 [pid 5871] mkdir("./file2", 0777 [pid 5870] <... futex resumed>) = 0 [pid 5869] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... close resumed>) = 0 [pid 5830] rmdir("./2" [pid 5875] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5873] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5872] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5870] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] rmdir("./2/file1" [pid 5875] <... openat resumed>) = 4 [pid 5833] <... rmdir resumed>) = 0 [pid 5875] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... rmdir resumed>) = 0 [pid 5875] <... futex resumed>) = 1 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5875] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5833] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] unlink("./2/binderfs") = 0 [pid 5833] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5833] close(3 [pid 5830] mkdir("./3", 0777 [pid 5833] <... close resumed>) = 0 [pid 5833] rmdir("./2" [pid 5830] <... mkdir resumed>) = 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5833] mkdir("./3", 0777) = 0 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 5833] ioctl(3, LOOP_CLR_FD) = 0 [pid 5833] close(3 [pid 5873] <... openat resumed>) = 4 [pid 5872] <... futex resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 5830] ioctl(3, LOOP_CLR_FD) = 0 [pid 5830] close(3 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5830] <... close resumed>) = 0 ./strace-static-x86_64: Process 5876 attached [pid 5873] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5872] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5871] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5873] <... futex resumed>) = 1 [pid 5872] <... futex resumed>) = 1 [pid 5869] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5873] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5872] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5869] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5875] <... futex resumed>) = 0 [pid 5869] <... futex resumed>) = 0 [pid 5875] mkdir("./file2", 0777 [pid 5870] <... futex resumed>) = 0 [ 98.362556][ T5871] exFAT-fs (loop3): error, data size is invalid(9000) [ 98.375331][ T5871] exFAT-fs (loop3): Filesystem has been set read-only [pid 5869] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5873] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5870] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5869] <... mmap resumed>) = 0x7f47693ee000 ./strace-static-x86_64: Process 5877 attached [pid 5873] mkdir("./file2", 0777 [pid 5870] <... futex resumed>) = 0 [pid 5869] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5870] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5876] set_robust_list(0x5555612166a0, 24 [pid 5871] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5869] <... mprotect resumed>) = 0 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5876 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5877 [pid 5876] <... set_robust_list resumed>) = 0 [pid 5876] chdir("./3") = 0 [pid 5876] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5876] setpgid(0, 0) = 0 [pid 5876] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5876] write(3, "1000", 4) = 4 [pid 5876] close(3) = 0 [pid 5876] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5876] write(1, "executing program\n", 18) = 18 [pid 5876] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5876] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 5876] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5876] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 5876] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5871] +++ killed by SIGSEGV +++ executing program [pid 5876] <... mprotect resumed>) = 0 [pid 5877] set_robust_list(0x5555612166a0, 24 [pid 5875] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5876] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5875] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5877] <... set_robust_list resumed>) = 0 [pid 5876] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5877] chdir("./3") = 0 [pid 5876] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5877] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 5878 attached ) = 0 [pid 5872] <... futex resumed>) = ? [pid 5878] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5877] setpgid(0, 0 [pid 5876] <... clone3 resumed> => {parent_tid=[5878]}, 88) = 5878 [pid 5875] +++ killed by SIGSEGV +++ [pid 5878] <... rseq resumed>) = 0 [pid 5877] <... setpgid resumed>) = 0 [pid 5876] rt_sigprocmask(SIG_SETMASK, [], [pid 5878] set_robust_list(0x7f476942f9a0, 24 [pid 5876] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5878] <... set_robust_list resumed>) = 0 [pid 5876] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5878] rt_sigprocmask(SIG_SETMASK, [], [pid 5876] <... futex resumed>) = 0 [pid 5878] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 98.414935][ T5875] exFAT-fs (loop2): error, data size is invalid(9000) [ 98.428498][ T5873] exFAT-fs (loop0): error, data size is invalid(9000) [ 98.438848][ T5875] exFAT-fs (loop2): Filesystem has been set read-only [pid 5876] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5878] memfd_create("syzkaller", 0 [pid 5877] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5873] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5872] +++ killed by SIGSEGV +++ [pid 5869] +++ killed by SIGSEGV +++ [pid 5878] <... memfd_create resumed>) = 3 [pid 5877] <... openat resumed>) = 3 [pid 5873] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5869, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5872, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5878] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5877] write(3, "1000", 4 [pid 5870] <... futex resumed>) = ? [pid 5878] <... mmap resumed>) = 0x7f4761000000 [pid 5877] <... write resumed>) = 4 [pid 5873] +++ killed by SIGSEGV +++ [pid 5870] +++ killed by SIGSEGV +++ [pid 5878] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5832] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5870, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5832] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] restart_syscall(<... resuming interrupted clone ...> [pid 5878] <... write resumed>) = 131072 [pid 5877] close(3 [pid 5832] <... openat resumed>) = 3 [pid 5831] <... openat resumed>) = 3 [pid 5832] newfstatat(3, "", [pid 5831] newfstatat(3, "", [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5878] munmap(0x7f4761000000, 138412032 [pid 5832] getdents64(3, [pid 5831] getdents64(3, [pid 5878] <... munmap resumed>) = 0 [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5832] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... restart_syscall resumed>) = 0 [pid 5878] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5877] <... close resumed>) = 0 [pid 5829] umount2("./2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5878] <... openat resumed>) = 4 [pid 5877] symlink("/dev/binderfs", "./binderfs" [pid 5832] <... umount2 resumed>) = 0 [pid 5831] <... umount2 resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 98.458830][ T5873] exFAT-fs (loop0): Filesystem has been set read-only [pid 5829] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORYexecuting program [pid 5877] <... symlink resumed>) = 0 [pid 5829] <... openat resumed>) = 3 [pid 5878] ioctl(4, LOOP_SET_FD, 3 [pid 5877] write(1, "executing program\n", 18 [pid 5831] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] newfstatat(3, "", [pid 5877] <... write resumed>) = 18 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] newfstatat(AT_FDCWD, "./3/file1", [pid 5877] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] getdents64(3, [pid 5877] <... futex resumed>) = 0 [pid 5832] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5877] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5877] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5832] newfstatat(AT_FDCWD, "./2/file1", [pid 5829] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5877] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5877] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5877] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 5832] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... openat resumed>) = 4 [pid 5829] <... umount2 resumed>) = 0 [pid 5877] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5831] newfstatat(4, "", [pid 5877] <... mprotect resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5877] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] <... openat resumed>) = 4 [pid 5831] getdents64(4, [pid 5829] newfstatat(AT_FDCWD, "./2/file1", [pid 5877] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] newfstatat(4, "", [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5877] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] getdents64(4, [pid 5829] umount2("./2/file1", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5879 attached [pid 5832] getdents64(4, [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] getdents64(4, [pid 5829] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] <... openat resumed>) = 4 [pid 5832] close(4) = 0 [pid 5832] rmdir("./2/file1") = 0 [pid 5878] <... ioctl resumed>) = 0 [pid 5877] <... clone3 resumed> => {parent_tid=[5879]}, 88) = 5879 [pid 5831] close(4 [pid 5829] newfstatat(4, "", [pid 5879] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5878] close(3 [pid 5877] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... close resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5879] <... rseq resumed>) = 0 [pid 5878] <... close resumed>) = 0 [pid 5877] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] rmdir("./3/file1" [pid 5829] getdents64(4, [pid 5879] set_robust_list(0x7f476942f9a0, 24 [pid 5878] close(4 [pid 5877] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] newfstatat(AT_FDCWD, "./2/binderfs", [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5878] <... close resumed>) = 0 [pid 5877] <... futex resumed>) = 0 [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] getdents64(4, [pid 5879] <... set_robust_list resumed>) = 0 [pid 5878] mkdir("./file1", 0777 [pid 5877] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5832] unlink("./2/binderfs" [pid 5831] <... rmdir resumed>) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5879] rt_sigprocmask(SIG_SETMASK, [], [pid 5878] <... mkdir resumed>) = 0 [pid 5832] <... unlink resumed>) = 0 [pid 5829] close(4 [pid 5832] getdents64(3, [pid 5829] <... close resumed>) = 0 [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] rmdir("./2/file1" [pid 5879] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] close(3 [ 98.500029][ T5878] loop4: detected capacity change from 0 to 256 [pid 5831] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... rmdir resumed>) = 0 [pid 5879] memfd_create("syzkaller", 0 [pid 5878] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5879] <... memfd_create resumed>) = 3 [pid 5831] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5879] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5879] <... mmap resumed>) = 0x7f4761000000 [pid 5831] unlink("./3/binderfs") = 0 [pid 5832] <... close resumed>) = 0 [pid 5831] getdents64(3, [pid 5879] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5832] rmdir("./2" [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] <... rmdir resumed>) = 0 [pid 5831] close(3 [pid 5879] <... write resumed>) = 131072 [pid 5832] mkdir("./3", 0777 [pid 5831] <... close resumed>) = 0 [pid 5879] munmap(0x7f4761000000, 138412032 [pid 5832] <... mkdir resumed>) = 0 [pid 5831] rmdir("./3" [pid 5829] umount2("./2/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... rmdir resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5829] unlink("./2/binderfs" [pid 5879] <... munmap resumed>) = 0 [pid 5832] <... openat resumed>) = 3 [pid 5831] mkdir("./4", 0777 [pid 5829] <... unlink resumed>) = 0 [pid 5879] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 5879] ioctl(4, LOOP_SET_FD, 3 [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5831] <... mkdir resumed>) = 0 [pid 5832] <... ioctl resumed>) = 0 [pid 5832] close(3) = 0 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5829] getdents64(3, [pid 5831] <... openat resumed>) = 3 [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5829] close(3 [pid 5831] <... ioctl resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 5831] close(3 [pid 5829] rmdir("./2" [pid 5831] <... close resumed>) = 0 [pid 5829] <... rmdir resumed>) = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] mkdir("./3", 0777 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5880 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] <... mkdir resumed>) = 0 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR./strace-static-x86_64: Process 5881 attached ./strace-static-x86_64: Process 5880 attached ) = 3 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5881 [pid 5829] ioctl(3, LOOP_CLR_FD) = 0 [pid 5881] set_robust_list(0x5555612166a0, 24 [pid 5829] close(3 [pid 5881] <... set_robust_list resumed>) = 0 [pid 5880] set_robust_list(0x5555612166a0, 24 [pid 5881] chdir("./4" [pid 5880] <... set_robust_list resumed>) = 0 [pid 5881] <... chdir resumed>) = 0 [pid 5880] chdir("./3" [pid 5829] <... close resumed>) = 0 [pid 5881] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5880] <... chdir resumed>) = 0 [pid 5881] <... prctl resumed>) = 0 [pid 5880] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5881] setpgid(0, 0 [pid 5880] <... prctl resumed>) = 0 [pid 5881] <... setpgid resumed>) = 0 [pid 5880] setpgid(0, 0 [pid 5881] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5880] <... setpgid resumed>) = 0 [pid 5881] <... openat resumed>) = 3 [pid 5880] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [ 98.589531][ T5879] loop1: detected capacity change from 0 to 256 [pid 5881] write(3, "1000", 4 [pid 5880] <... openat resumed>) = 3 [pid 5881] <... write resumed>) = 4 [pid 5880] write(3, "1000", 4./strace-static-x86_64: Process 5882 attached [pid 5881] close(3 [pid 5880] <... write resumed>) = 4 [pid 5879] <... ioctl resumed>) = 0 [pid 5882] set_robust_list(0x5555612166a0, 24 [pid 5881] <... close resumed>) = 0 [pid 5880] close(3 [pid 5879] close(3executing program [pid 5882] <... set_robust_list resumed>) = 0 [pid 5881] symlink("/dev/binderfs", "./binderfs" [pid 5880] <... close resumed>) = 0 [pid 5879] <... close resumed>) = 0 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5882 [pid 5880] symlink("/dev/binderfs", "./binderfs" [pid 5879] close(4 [pid 5882] chdir("./3" [pid 5881] <... symlink resumed>) = 0 [pid 5880] <... symlink resumed>) = 0 [pid 5879] <... close resumed>) = 0 [pid 5882] <... chdir resumed>) = 0 [pid 5881] write(1, "executing program\n", 18) = 18 [pid 5881] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5881] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 5881] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5882] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5881] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5879] mkdir("./file1", 0777 [pid 5882] <... prctl resumed>) = 0 [pid 5880] write(1, "executing program\n", 18 [pid 5881] <... mmap resumed>) = 0x7f476940f000 executing program [pid 5881] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5882] setpgid(0, 0 [pid 5881] <... mprotect resumed>) = 0 [pid 5880] <... write resumed>) = 18 [pid 5879] <... mkdir resumed>) = 0 [pid 5882] <... setpgid resumed>) = 0 [pid 5880] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5882] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5881] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5880] <... futex resumed>) = 0 [pid 5881] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5882] <... openat resumed>) = 3 [pid 5881] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5880] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5882] write(3, "1000", 4 [pid 5879] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 5880] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5882] <... write resumed>) = 4 [pid 5881] <... clone3 resumed> => {parent_tid=[5883]}, 88) = 5883 ./strace-static-x86_64: Process 5883 attached [pid 5882] close(3 [pid 5881] rt_sigprocmask(SIG_SETMASK, [], [pid 5880] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5883] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5882] <... close resumed>) = 0 [pid 5881] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5880] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5882] symlink("/dev/binderfs", "./binderfs" [pid 5881] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5880] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5882] <... symlink resumed>) = 0 [pid 5881] <... futex resumed>) = 0 [pid 5880] <... mmap resumed>) = 0x7f476940f000 [pid 5881] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5880] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5883] <... rseq resumed>) = 0 [pid 5882] write(1, "executing program\n", 18 [pid 5880] <... mprotect resumed>) = 0 [pid 5883] set_robust_list(0x7f476942f9a0, 24 [pid 5880] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5883] <... set_robust_list resumed>) = 0 [pid 5880] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5883] rt_sigprocmask(SIG_SETMASK, [], [pid 5880] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5883] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5884 attached [pid 5884] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5883] memfd_create("syzkaller", 0 [pid 5880] <... clone3 resumed> => {parent_tid=[5884]}, 88) = 5884 [pid 5884] <... rseq resumed>) = 0 [pid 5883] <... memfd_create resumed>) = 3 [pid 5880] rt_sigprocmask(SIG_SETMASK, [], [pid 5884] set_robust_list(0x7f476942f9a0, 24) = 0 [pid 5884] rt_sigprocmask(SIG_SETMASK, [], [pid 5883] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5880] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5884] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5884] memfd_create("syzkaller", 0 [pid 5883] <... mmap resumed>) = 0x7f4761000000 [pid 5880] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5884] <... memfd_create resumed>) = 3 [pid 5884] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5880] <... futex resumed>) = 0 executing program [pid 5884] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5878] <... mount resumed>) = 0 [pid 5882] <... write resumed>) = 18 [pid 5880] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5878] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [ 98.639125][ T5878] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5883] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5882] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5884] <... write resumed>) = 131072 [pid 5883] <... write resumed>) = 131072 [pid 5882] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5878] chdir("./file1" [pid 5883] munmap(0x7f4761000000, 138412032 [pid 5882] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5878] <... chdir resumed>) = 0 [pid 5884] munmap(0x7f4761000000, 138412032 [pid 5882] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5878] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5884] <... munmap resumed>) = 0 [pid 5882] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5878] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5878] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5878] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5884] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5876] <... futex resumed>) = 0 [pid 5884] <... openat resumed>) = 4 [pid 5876] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5878] <... futex resumed>) = 0 [pid 5876] <... futex resumed>) = 1 [pid 5884] ioctl(4, LOOP_SET_FD, 3 [pid 5878] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5876] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5882] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 5883] <... munmap resumed>) = 0 [pid 5882] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5883] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5882] <... mprotect resumed>) = 0 [pid 5883] <... openat resumed>) = 4 [pid 5882] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5883] ioctl(4, LOOP_SET_FD, 3 [pid 5882] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5882] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5878] <... openat resumed>) = 4 [pid 5878] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5876] <... futex resumed>) = 0 [pid 5876] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5876] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5878] mkdir("./file2", 0777./strace-static-x86_64: Process 5885 attached [pid 5883] <... ioctl resumed>) = 0 [pid 5882] <... clone3 resumed> => {parent_tid=[5885]}, 88) = 5885 [pid 5885] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053) = 0 [pid 5882] rt_sigprocmask(SIG_SETMASK, [], [pid 5885] set_robust_list(0x7f476942f9a0, 24 [pid 5882] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5885] <... set_robust_list resumed>) = 0 [pid 5882] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5879] <... mount resumed>) = 0 [pid 5885] rt_sigprocmask(SIG_SETMASK, [], [pid 5882] <... futex resumed>) = 0 [pid 5885] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5882] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5879] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5885] memfd_create("syzkaller", 0) = 3 [pid 5879] chdir("./file1") = 0 [pid 5885] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5879] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5885] <... mmap resumed>) = 0x7f4761000000 [pid 5879] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5884] <... ioctl resumed>) = 0 [ 98.714889][ T5879] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 98.719443][ T5884] loop3: detected capacity change from 0 to 256 [ 98.745125][ T5883] loop2: detected capacity change from 0 to 256 [ 98.747573][ T5878] exFAT-fs (loop4): error, data size is invalid(9000) [pid 5879] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5885] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5879] <... futex resumed>) = 1 [pid 5884] close(3 [pid 5883] close(3 [pid 5877] <... futex resumed>) = 0 [pid 5879] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5885] <... write resumed>) = 131072 [pid 5877] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5884] <... close resumed>) = 0 [pid 5879] <... futex resumed>) = 0 [pid 5877] <... futex resumed>) = 1 [pid 5879] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5877] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5883] <... close resumed>) = 0 [pid 5884] close(4) = 0 [pid 5884] mkdir("./file1", 0777) = 0 [pid 5883] close(4 [pid 5879] <... openat resumed>) = 4 [pid 5885] munmap(0x7f4761000000, 138412032 [pid 5878] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5876] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5884] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5879] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5876] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5879] <... futex resumed>) = 1 [pid 5877] <... futex resumed>) = 0 [pid 5876] <... futex resumed>) = 0 [pid 5883] <... close resumed>) = 0 [pid 5879] mkdir("./file2", 0777 [pid 5877] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5876] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5885] <... munmap resumed>) = 0 [pid 5883] mkdir("./file1", 0777 [pid 5878] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5877] <... futex resumed>) = 0 [pid 5876] <... mmap resumed>) = 0x7f47693ee000 [pid 5885] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5877] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5885] <... openat resumed>) = 4 [pid 5878] +++ killed by SIGSEGV +++ [pid 5885] ioctl(4, LOOP_SET_FD, 3 [pid 5883] <... mkdir resumed>) = 0 [pid 5876] +++ killed by SIGSEGV +++ [pid 5883] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5876, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [ 98.772814][ T5878] exFAT-fs (loop4): Filesystem has been set read-only [ 98.812647][ T5879] exFAT-fs (loop1): error, data size is invalid(9000) [pid 5833] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5833] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 5833] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5879] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5884] <... mount resumed>) = 0 [pid 5884] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5884] chdir("./file1" [pid 5879] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5884] <... chdir resumed>) = 0 [pid 5884] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5884] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [ 98.854590][ T5884] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 98.871604][ T5879] exFAT-fs (loop1): Filesystem has been set read-only [ 98.881022][ T5883] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5884] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5880] <... futex resumed>) = 0 [pid 5877] <... futex resumed>) = ? [pid 5833] <... umount2 resumed>) = 0 [pid 5885] <... ioctl resumed>) = 0 [pid 5880] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5879] +++ killed by SIGSEGV +++ [pid 5877] +++ killed by SIGSEGV +++ [pid 5833] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5884] <... futex resumed>) = 0 [pid 5880] <... futex resumed>) = 1 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5877, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5885] close(3 [pid 5884] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5880] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] newfstatat(AT_FDCWD, "./3/file1", [pid 5885] <... close resumed>) = 0 [pid 5884] <... openat resumed>) = 4 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5885] close(4 [pid 5884] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5885] <... close resumed>) = 0 [pid 5884] <... futex resumed>) = 1 [pid 5883] <... mount resumed>) = 0 [pid 5880] <... futex resumed>) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5885] mkdir("./file1", 0777 [ 98.913428][ T5885] loop0: detected capacity change from 0 to 256 [pid 5884] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5883] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5880] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5885] <... mkdir resumed>) = 0 [pid 5884] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5883] <... openat resumed>) = 3 [pid 5880] <... futex resumed>) = 0 [pid 5833] <... openat resumed>) = 4 [pid 5830] <... openat resumed>) = 3 [pid 5885] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5883] chdir("./file1" [pid 5880] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] newfstatat(4, "", [pid 5884] mkdir("./file2", 0777 [pid 5830] newfstatat(3, "", [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] getdents64(4, [pid 5883] <... chdir resumed>) = 0 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] getdents64(3, [pid 5883] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5833] getdents64(4, [pid 5883] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5833] close(4) = 0 [pid 5830] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5883] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] rmdir("./3/file1") = 0 [pid 5883] <... futex resumed>) = 1 [pid 5881] <... futex resumed>) = 0 [pid 5833] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5883] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 5881] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5881] <... futex resumed>) = 0 [pid 5883] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5881] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] unlink("./3/binderfs") = 0 [pid 5883] <... openat resumed>) = 4 [ 98.978282][ T5884] exFAT-fs (loop3): error, data size is invalid(9000) [pid 5833] getdents64(3, [pid 5885] <... mount resumed>) = 0 [pid 5883] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5880] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5833] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5885] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5883] <... futex resumed>) = 1 [pid 5880] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] close(3 [pid 5883] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5880] <... futex resumed>) = 0 [pid 5885] <... openat resumed>) = 3 [pid 5881] <... futex resumed>) = 0 [pid 5880] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] <... close resumed>) = 0 [pid 5881] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5880] <... mmap resumed>) = 0x7f47693ee000 [pid 5833] rmdir("./3" [pid 5885] chdir("./file1" [pid 5880] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5885] <... chdir resumed>) = 0 [pid 5883] <... futex resumed>) = 0 [pid 5881] <... futex resumed>) = 1 [pid 5880] <... mprotect resumed>) = 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5883] mkdir("./file2", 0777 [pid 5880] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5885] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5833] mkdir("./4", 0777 [pid 5880] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5885] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5881] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5880] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5833] <... mkdir resumed>) = 0 [pid 5885] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5886 attached ) = 1 [pid 5882] <... futex resumed>) = 0 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5886] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5885] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5882] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5880] <... clone3 resumed> => {parent_tid=[5886]}, 88) = 5886 [pid 5886] <... rseq resumed>) = 0 [pid 5833] <... openat resumed>) = 3 [pid 5886] set_robust_list(0x7f476940e9a0, 24 [pid 5882] <... futex resumed>) = 0 [pid 5880] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5882] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5880] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] <... ioctl resumed>) = 0 [ 99.014102][ T5885] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 99.026749][ T5884] exFAT-fs (loop3): Filesystem has been set read-only [ 99.052911][ T5883] exFAT-fs (loop2): error, data size is invalid(9000) [pid 5886] <... set_robust_list resumed>) = 0 [pid 5885] <... openat resumed>) = 4 [pid 5880] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] close(3 [pid 5830] <... umount2 resumed>) = 0 [pid 5880] <... futex resumed>) = 0 [pid 5830] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5830] newfstatat(AT_FDCWD, "./3/file1", [pid 5880] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5886] rt_sigprocmask(SIG_SETMASK, [], [pid 5885] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5886] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5885] <... futex resumed>) = 1 [pid 5882] <... futex resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5886] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5885] mkdir("./file2", 0777 [pid 5882] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5830] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5830] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] close(4 [pid 5882] <... futex resumed>) = 0 [pid 5830] <... close resumed>) = 0 [pid 5830] rmdir("./3/file1"./strace-static-x86_64: Process 5887 attached [pid 5886] <... ioctl resumed>) = 0 [pid 5884] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5882] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] <... rmdir resumed>) = 0 [pid 5887] set_robust_list(0x5555612166a0, 24 [pid 5886] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5884] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5887 [pid 5830] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5884] +++ killed by SIGSEGV +++ [pid 5880] <... futex resumed>) = ? [pid 5830] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5886] <... futex resumed>) = ? [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] unlink("./3/binderfs") = 0 [pid 5830] getdents64(3, [pid 5887] <... set_robust_list resumed>) = 0 [pid 5886] +++ killed by SIGSEGV +++ [pid 5880] +++ killed by SIGSEGV +++ [pid 5883] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5881] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5881] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5880, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5887] chdir("./4" [pid 5881] <... futex resumed>) = 0 [pid 5832] restart_syscall(<... resuming interrupted clone ...> [pid 5830] close(3 [pid 5881] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5832] <... restart_syscall resumed>) = 0 [pid 5830] <... close resumed>) = 0 [ 99.071879][ T5883] exFAT-fs (loop2): Filesystem has been set read-only [ 99.095092][ T5885] exFAT-fs (loop0): error, data size is invalid(9000) [pid 5887] <... chdir resumed>) = 0 [pid 5881] <... mmap resumed>) = 0x7f47693ee000 [pid 5830] rmdir("./3" [pid 5883] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5881] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5830] <... rmdir resumed>) = 0 [pid 5881] <... mprotect resumed>) = ? [pid 5832] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] mkdir("./4", 0777 [pid 5887] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5885] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5883] +++ killed by SIGSEGV +++ [pid 5881] +++ killed by SIGSEGV +++ [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... mkdir resumed>) = 0 [pid 5887] <... prctl resumed>) = 0 [pid 5885] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5832] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5887] setpgid(0, 0) = 0 [pid 5882] <... futex resumed>) = ? [pid 5832] <... openat resumed>) = 3 [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5881, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5887] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5831] restart_syscall(<... resuming interrupted clone ...> [pid 5830] <... openat resumed>) = 3 [pid 5830] ioctl(3, LOOP_CLR_FD) = 0 [pid 5830] close(3) = 0 [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5885] +++ killed by SIGSEGV +++ [pid 5882] +++ killed by SIGSEGV +++ [pid 5887] <... openat resumed>) = 3 [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5882, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5832] newfstatat(3, "", [pid 5829] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 5888 attached [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5888 [pid 5832] getdents64(3, [pid 5888] set_robust_list(0x5555612166a0, 24 [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5888] <... set_robust_list resumed>) = 0 [pid 5832] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5888] chdir("./4" [pid 5829] <... restart_syscall resumed>) = 0 [pid 5887] write(3, "1000", 4 [pid 5829] umount2("./3", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... restart_syscall resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5831] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] newfstatat(3, "", [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5888] <... chdir resumed>) = 0 [pid 5831] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] getdents64(3, [pid 5888] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5887] <... write resumed>) = 4 [pid 5887] close(3 [pid 5831] <... openat resumed>) = 3 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5888] <... prctl resumed>) = 0 [pid 5831] newfstatat(3, "", [pid 5888] setpgid(0, 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5888] <... setpgid resumed>) = 0 [pid 5831] getdents64(3, [pid 5888] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5888] <... openat resumed>) = 3 [pid 5831] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5888] write(3, "1000", 4 [pid 5829] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5888] <... write resumed>) = 4 [pid 5887] <... close resumed>) = 0 [pid 5888] close(3) = 0 [ 99.133181][ T5885] exFAT-fs (loop0): Filesystem has been set read-only [pid 5888] symlink("/dev/binderfs", "./binderfs"executing program [pid 5887] symlink("/dev/binderfs", "./binderfs" [pid 5888] <... symlink resumed>) = 0 [pid 5887] <... symlink resumed>) = 0 [pid 5832] <... umount2 resumed>) = 0 [pid 5831] <... umount2 resumed>) = 0 [pid 5829] <... umount2 resumed>) = 0 [pid 5887] write(1, "executing program\n", 18 [pid 5831] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5887] <... write resumed>) = 18 executing program [pid 5888] write(1, "executing program\n", 18 [pid 5887] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5888] <... write resumed>) = 18 [pid 5829] newfstatat(AT_FDCWD, "./3/file1", [pid 5888] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5888] <... futex resumed>) = 0 [pid 5832] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5888] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5888] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5887] <... futex resumed>) = 0 [pid 5832] newfstatat(AT_FDCWD, "./3/file1", [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5887] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5829] <... openat resumed>) = 4 [pid 5829] newfstatat(4, "", [pid 5888] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5888] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] umount2("./3/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] getdents64(4, [pid 5888] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] newfstatat(AT_FDCWD, "./4/file1", [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5888] <... mmap resumed>) = 0x7f476940f000 [pid 5832] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] getdents64(4, [pid 5888] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5832] <... openat resumed>) = 4 [pid 5831] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5888] <... mprotect resumed>) = 0 [pid 5832] newfstatat(4, "", [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] close(4 [pid 5888] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] <... close resumed>) = 0 [pid 5888] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] getdents64(4, [pid 5831] <... openat resumed>) = 4 [pid 5829] rmdir("./3/file1" [pid 5888] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5887] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] newfstatat(4, "", [pid 5829] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5889 attached [pid 5887] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5832] getdents64(4, [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5887] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5889] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5888] <... clone3 resumed> => {parent_tid=[5889]}, 88) = 5889 [pid 5887] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5832] close(4 [pid 5889] <... rseq resumed>) = 0 [pid 5888] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... close resumed>) = 0 [pid 5831] getdents64(4, [pid 5829] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5889] set_robust_list(0x7f476942f9a0, 24 [pid 5887] <... mmap resumed>) = 0x7f476940f000 [pid 5832] rmdir("./3/file1" [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5887] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5832] <... rmdir resumed>) = 0 [pid 5831] getdents64(4, [pid 5829] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5887] <... mprotect resumed>) = 0 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] close(4 [pid 5829] unlink("./3/binderfs" [pid 5889] <... set_robust_list resumed>) = 0 [pid 5888] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5887] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] umount2("./3/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... close resumed>) = 0 [pid 5829] <... unlink resumed>) = 0 [pid 5889] rt_sigprocmask(SIG_SETMASK, [], [pid 5888] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5889] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5888] <... futex resumed>) = 0 [pid 5832] newfstatat(AT_FDCWD, "./3/binderfs", [pid 5889] memfd_create("syzkaller", 0 [pid 5888] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5889] <... memfd_create resumed>) = 3 [pid 5887] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5831] rmdir("./4/file1" [pid 5829] getdents64(3, [pid 5889] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5832] unlink("./3/binderfs" [pid 5831] <... rmdir resumed>) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5889] <... mmap resumed>) = 0x7f4761000000 [pid 5832] <... unlink resumed>) = 0 [pid 5831] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] close(3 [pid 5889] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5887] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... close resumed>) = 0 ./strace-static-x86_64: Process 5890 attached [pid 5832] getdents64(3, [pid 5831] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5829] rmdir("./3" [pid 5890] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] <... rmdir resumed>) = 0 [pid 5890] <... rseq resumed>) = 0 [pid 5832] close(3 [pid 5831] unlink("./4/binderfs" [pid 5890] set_robust_list(0x7f476942f9a0, 24 [pid 5889] <... write resumed>) = 131072 [pid 5887] <... clone3 resumed> => {parent_tid=[5890]}, 88) = 5890 [pid 5832] <... close resumed>) = 0 [pid 5831] <... unlink resumed>) = 0 [pid 5829] mkdir("./4", 0777 [pid 5887] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] rmdir("./3" [pid 5831] getdents64(3, [pid 5829] <... mkdir resumed>) = 0 [pid 5890] <... set_robust_list resumed>) = 0 [pid 5887] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... rmdir resumed>) = 0 [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5889] munmap(0x7f4761000000, 138412032 [pid 5831] close(3 [pid 5889] <... munmap resumed>) = 0 [pid 5831] <... close resumed>) = 0 [pid 5887] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5890] rt_sigprocmask(SIG_SETMASK, [], [pid 5889] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5832] mkdir("./4", 0777 [pid 5831] rmdir("./4" [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5889] <... openat resumed>) = 4 [pid 5831] <... rmdir resumed>) = 0 [pid 5829] <... openat resumed>) = 3 [pid 5889] ioctl(4, LOOP_SET_FD, 3 [pid 5832] <... mkdir resumed>) = 0 [pid 5829] ioctl(3, LOOP_CLR_FD) = 0 [pid 5829] close(3) = 0 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5890] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5887] <... futex resumed>) = 0 [pid 5831] mkdir("./5", 0777 [pid 5887] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5891 attached [pid 5890] memfd_create("syzkaller", 0 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5831] <... mkdir resumed>) = 0 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5891 [pid 5890] <... memfd_create resumed>) = 3 [pid 5832] <... openat resumed>) = 3 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5890] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5831] <... openat resumed>) = 3 [pid 5832] <... ioctl resumed>) = 0 [pid 5891] set_robust_list(0x5555612166a0, 24 [pid 5832] close(3 [pid 5891] <... set_robust_list resumed>) = 0 [pid 5832] <... close resumed>) = 0 [pid 5891] chdir("./4" [pid 5890] <... mmap resumed>) = 0x7f4761000000 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5890] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5831] <... ioctl resumed>) = 0 [pid 5891] <... chdir resumed>) = 0 [pid 5831] close(3 [pid 5891] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5831] <... close resumed>) = 0 ./strace-static-x86_64: Process 5892 attached [pid 5891] <... prctl resumed>) = 0 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5891] setpgid(0, 0) = 0 [pid 5891] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5892] set_robust_list(0x5555612166a0, 24) = 0 [pid 5892] chdir("./4" [pid 5891] <... openat resumed>) = 3 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5892 ./strace-static-x86_64: Process 5893 attached [pid 5892] <... chdir resumed>) = 0 [pid 5892] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5893 [pid 5893] set_robust_list(0x5555612166a0, 24 [pid 5892] <... prctl resumed>) = 0 [pid 5892] setpgid(0, 0 [pid 5891] write(3, "1000", 4 [pid 5892] <... setpgid resumed>) = 0 [pid 5893] <... set_robust_list resumed>) = 0 [pid 5893] chdir("./5" [pid 5892] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5891] <... write resumed>) = 4 [pid 5891] close(3 [pid 5893] <... chdir resumed>) = 0 [pid 5892] <... openat resumed>) = 3 [pid 5891] <... close resumed>) = 0 [pid 5893] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5891] symlink("/dev/binderfs", "./binderfs" [pid 5893] <... prctl resumed>) = 0 [pid 5891] <... symlink resumed>) = 0 [pid 5893] setpgid(0, 0 [pid 5892] write(3, "1000", 4 [pid 5893] <... setpgid resumed>) = 0 [pid 5892] <... write resumed>) = 4 executing program [pid 5893] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5892] close(3 [pid 5891] write(1, "executing program\n", 18) = 18 [pid 5892] <... close resumed>) = 0 [pid 5891] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5892] symlink("/dev/binderfs", "./binderfs" [pid 5891] <... futex resumed>) = 0 [pid 5893] <... openat resumed>) = 3 [pid 5892] <... symlink resumed>) = 0 [pid 5891] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, executing program [pid 5893] write(3, "1000", 4 [pid 5891] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5892] write(1, "executing program\n", 18 [pid 5890] <... write resumed>) = 131072 [pid 5892] <... write resumed>) = 18 [pid 5892] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5892] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 5890] munmap(0x7f4761000000, 138412032 [pid 5892] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5891] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5892] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 5892] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5891] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5892] <... mprotect resumed>) = 0 [pid 5891] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5892] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5891] <... mmap resumed>) = 0x7f476940f000 [pid 5893] <... write resumed>) = 4 [pid 5892] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5891] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5893] close(3 [pid 5892] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5891] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 5894 attached [pid 5893] <... close resumed>) = 0 [pid 5891] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5893] symlink("/dev/binderfs", "./binderfs" [pid 5892] <... clone3 resumed> => {parent_tid=[5894]}, 88) = 5894 [pid 5893] <... symlink resumed>) = 0 [pid 5892] rt_sigprocmask(SIG_SETMASK, [], [pid 5891] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5892] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5891] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5890] <... munmap resumed>) = 0 [pid 5894] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5892] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5894] <... rseq resumed>) = 0 executing program [pid 5893] write(1, "executing program\n", 18 [pid 5892] <... futex resumed>) = 0 [pid 5894] set_robust_list(0x7f476942f9a0, 24 [pid 5893] <... write resumed>) = 18 [pid 5892] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5891] <... clone3 resumed> => {parent_tid=[5895]}, 88) = 5895 [pid 5894] <... set_robust_list resumed>) = 0 [pid 5893] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5891] rt_sigprocmask(SIG_SETMASK, [], [pid 5890] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5894] rt_sigprocmask(SIG_SETMASK, [], [pid 5893] <... futex resumed>) = 0 [pid 5891] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5895 attached [pid 5894] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5893] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5891] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5890] <... openat resumed>) = 4 [pid 5890] ioctl(4, LOOP_SET_FD, 3 [pid 5895] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5894] memfd_create("syzkaller", 0 [pid 5893] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5891] <... futex resumed>) = 0 [pid 5893] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5891] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5894] <... memfd_create resumed>) = 3 [pid 5893] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5894] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5893] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5894] <... mmap resumed>) = 0x7f4761000000 [pid 5893] <... mmap resumed>) = 0x7f476940f000 [pid 5894] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5893] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5893] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 99.353003][ T5889] loop1: detected capacity change from 0 to 256 [pid 5893] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 5896 attached [pid 5895] <... rseq resumed>) = 0 [pid 5894] <... write resumed>) = 131072 [pid 5893] <... clone3 resumed> => {parent_tid=[5896]}, 88) = 5896 [pid 5893] rt_sigprocmask(SIG_SETMASK, [], [pid 5894] munmap(0x7f4761000000, 138412032 [pid 5893] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5896] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5894] <... munmap resumed>) = 0 [pid 5893] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5893] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5896] <... rseq resumed>) = 0 [pid 5896] set_robust_list(0x7f476942f9a0, 24 [pid 5894] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5896] <... set_robust_list resumed>) = 0 [pid 5896] rt_sigprocmask(SIG_SETMASK, [], [pid 5895] set_robust_list(0x7f476942f9a0, 24 [pid 5896] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5895] <... set_robust_list resumed>) = 0 [pid 5896] memfd_create("syzkaller", 0 [pid 5895] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5889] <... ioctl resumed>) = 0 [pid 5896] <... memfd_create resumed>) = 3 [pid 5896] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5895] memfd_create("syzkaller", 0 [pid 5889] close(3 [pid 5896] <... mmap resumed>) = 0x7f4761000000 [pid 5895] <... memfd_create resumed>) = 3 [pid 5889] <... close resumed>) = 0 [pid 5896] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5894] <... openat resumed>) = 4 [pid 5889] close(4 [pid 5895] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5894] ioctl(4, LOOP_SET_FD, 3 [pid 5895] <... mmap resumed>) = 0x7f4761000000 [pid 5889] <... close resumed>) = 0 [pid 5895] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5890] <... ioctl resumed>) = 0 [pid 5896] <... write resumed>) = 131072 [pid 5896] munmap(0x7f4761000000, 138412032) = 0 [pid 5896] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 5896] ioctl(4, LOOP_SET_FD, 3 [pid 5890] close(3 [pid 5889] mkdir("./file1", 0777 [pid 5895] <... write resumed>) = 131072 [ 99.402258][ T5890] loop4: detected capacity change from 0 to 256 [ 99.426022][ T5894] loop3: detected capacity change from 0 to 256 [pid 5894] <... ioctl resumed>) = 0 [pid 5895] munmap(0x7f4761000000, 138412032 [pid 5890] <... close resumed>) = 0 [pid 5889] <... mkdir resumed>) = 0 [pid 5890] close(4 [pid 5895] <... munmap resumed>) = 0 [pid 5894] close(3 [pid 5890] <... close resumed>) = 0 [pid 5889] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 5890] mkdir("./file1", 0777 [pid 5894] <... close resumed>) = 0 [pid 5894] close(4) = 0 [pid 5894] mkdir("./file1", 0777) = 0 [pid 5890] <... mkdir resumed>) = 0 [pid 5894] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5896] <... ioctl resumed>) = 0 [pid 5896] close(3) = 0 [pid 5896] close(4) = 0 [pid 5896] mkdir("./file1", 0777 [pid 5895] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5890] mount("/dev/loop4", "./file1", "exfat", 0, "" [ 99.454200][ T5896] loop2: detected capacity change from 0 to 256 [pid 5896] <... mkdir resumed>) = 0 [pid 5895] <... openat resumed>) = 4 [pid 5895] ioctl(4, LOOP_SET_FD, 3 [pid 5896] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5894] <... mount resumed>) = 0 [pid 5894] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5894] chdir("./file1") = 0 [pid 5894] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5894] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5892] <... futex resumed>) = 0 [pid 5894] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5892] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5894] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5892] <... futex resumed>) = 0 [pid 5894] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [ 99.495059][ T5894] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 99.520457][ T5895] loop0: detected capacity change from 0 to 256 [pid 5892] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5894] <... openat resumed>) = 4 [pid 5895] <... ioctl resumed>) = 0 [pid 5894] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [ 99.532231][ T5889] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 99.557114][ T5896] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5894] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5895] close(3 [pid 5892] <... futex resumed>) = 0 [pid 5895] <... close resumed>) = 0 [pid 5892] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5889] <... mount resumed>) = 0 [pid 5892] <... futex resumed>) = 1 [pid 5895] close(4 [pid 5892] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5894] <... futex resumed>) = 0 [pid 5895] <... close resumed>) = 0 [pid 5894] mkdir("./file2", 0777 [pid 5895] mkdir("./file1", 0777 [pid 5889] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5895] <... mkdir resumed>) = 0 [pid 5895] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5889] <... openat resumed>) = 3 [pid 5889] chdir("./file1") = 0 [pid 5889] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5889] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5896] <... mount resumed>) = 0 [pid 5894] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5892] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5889] <... futex resumed>) = 1 [pid 5888] <... futex resumed>) = 0 [pid 5896] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5892] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5889] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5888] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5896] <... openat resumed>) = 3 [pid 5892] <... futex resumed>) = 0 [pid 5889] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5888] <... futex resumed>) = 0 [pid 5896] chdir("./file1" [pid 5892] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5890] <... mount resumed>) = 0 [pid 5889] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5888] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5896] <... chdir resumed>) = 0 [pid 5892] <... mmap resumed>) = 0x7f47693ee000 [pid 5890] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5896] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5892] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5890] <... openat resumed>) = 3 [pid 5896] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5890] chdir("./file1" [pid 5896] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5894] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5896] <... futex resumed>) = 1 [pid 5893] <... futex resumed>) = 0 [pid 5890] <... chdir resumed>) = 0 [pid 5896] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5893] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5890] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5896] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5893] <... futex resumed>) = 0 [pid 5890] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5896] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5893] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5890] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5887] <... futex resumed>) = 0 [pid 5890] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5887] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5890] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5887] <... futex resumed>) = 0 [pid 5890] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5887] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5892] <... mprotect resumed>) = ? [ 99.584368][ T5890] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 99.604873][ T5894] exFAT-fs (loop3): error, data size is invalid(9000) [ 99.627209][ T5894] exFAT-fs (loop3): Filesystem has been set read-only [pid 5894] +++ killed by SIGSEGV +++ [pid 5892] +++ killed by SIGSEGV +++ [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5892, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=7 /* 0.07 s */} --- [pid 5832] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5832] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5889] <... openat resumed>) = 4 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5832] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 5832] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5896] <... openat resumed>) = 4 [pid 5890] <... openat resumed>) = 4 [pid 5896] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5890] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5893] <... futex resumed>) = 0 [pid 5893] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5889] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5893] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5889] <... futex resumed>) = 1 [pid 5888] <... futex resumed>) = 0 [pid 5889] mkdir("./file2", 0777 [pid 5888] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5896] <... futex resumed>) = 1 [pid 5896] mkdir("./file2", 0777 [pid 5890] <... futex resumed>) = 1 [pid 5887] <... futex resumed>) = 0 [pid 5890] mkdir("./file2", 0777 [pid 5887] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5888] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5887] <... futex resumed>) = 0 [ 99.695182][ T5889] exFAT-fs (loop1): error, data size is invalid(9000) [ 99.700230][ T5890] exFAT-fs (loop4): error, data size is invalid(9000) [ 99.713311][ T5896] exFAT-fs (loop2): error, data size is invalid(9000) [ 99.720928][ T5896] exFAT-fs (loop2): Filesystem has been set read-only [ 99.724777][ T5895] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5887] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5893] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5893] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5893] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5893] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5832] <... umount2 resumed>) = 0 [pid 5893] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5893] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5893] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5832] newfstatat(AT_FDCWD, "./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5893] <... clone3 resumed> => {parent_tid=[5897]}, 88) = 5897 [pid 5832] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5893] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5893] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5893] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... openat resumed>) = 4 [pid 5893] <... futex resumed>) = 0 [pid 5832] newfstatat(4, "", [pid 5893] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5832] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5832] close(4) = 0 [pid 5832] rmdir("./4/file1") = 0 [pid 5832] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./4/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] unlink("./4/binderfs") = 0 [pid 5832] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] close(3) = 0 [pid 5832] rmdir("./4"./strace-static-x86_64: Process 5897 attached [pid 5889] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5832] <... rmdir resumed>) = 0 [pid 5897] rseq(0x7f476940efe0, 0x20, 0, 0x53053053) = 0 [pid 5889] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5832] mkdir("./5", 0777 [pid 5897] set_robust_list(0x7f476940e9a0, 24 [pid 5888] <... futex resumed>) = ? [pid 5832] <... mkdir resumed>) = 0 [pid 5897] <... set_robust_list resumed>) = 0 [pid 5896] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5895] <... mount resumed>) = 0 [pid 5889] +++ killed by SIGSEGV +++ [pid 5888] +++ killed by SIGSEGV +++ [pid 5890] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5887] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5897] rt_sigprocmask(SIG_SETMASK, [], [pid 5896] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5895] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5890] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5887] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... openat resumed>) = 3 [pid 5897] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5895] <... openat resumed>) = 3 [pid 5887] <... futex resumed>) = 3 [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5897] +++ killed by SIGSEGV +++ [pid 5895] chdir("./file1" [pid 5893] <... futex resumed>) = ? [pid 5832] <... ioctl resumed>) = 0 [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5888, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5895] <... chdir resumed>) = 0 [pid 5832] close(3 [pid 5830] restart_syscall(<... resuming interrupted clone ...> [pid 5832] <... close resumed>) = 0 [pid 5830] <... restart_syscall resumed>) = 0 [ 99.746677][ T5889] exFAT-fs (loop1): Filesystem has been set read-only [ 99.782155][ T5890] exFAT-fs (loop4): Filesystem has been set read-only [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5898 attached [pid 5895] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5890] +++ killed by SIGSEGV +++ [pid 5887] +++ killed by SIGSEGV +++ [pid 5895] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5887, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5898 [pid 5830] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5898] set_robust_list(0x5555612166a0, 24 [pid 5895] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5898] <... set_robust_list resumed>) = 0 [pid 5896] +++ killed by SIGSEGV +++ [pid 5895] <... futex resumed>) = 1 [pid 5893] +++ killed by SIGSEGV +++ [pid 5891] <... futex resumed>) = 0 [pid 5895] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5891] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5895] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5891] <... futex resumed>) = 0 [pid 5895] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5891] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5893, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5830] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5833] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... openat resumed>) = 3 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] newfstatat(3, "", [pid 5898] chdir("./5" [pid 5895] <... openat resumed>) = 4 [pid 5833] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5898] <... chdir resumed>) = 0 [pid 5895] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... openat resumed>) = 3 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5898] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5895] <... futex resumed>) = 0 [pid 5833] newfstatat(3, "", [pid 5831] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5898] <... prctl resumed>) = 0 [pid 5895] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] getdents64(3, [pid 5898] setpgid(0, 0 [pid 5831] <... openat resumed>) = 3 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5898] <... setpgid resumed>) = 0 [pid 5833] getdents64(3, [pid 5831] newfstatat(3, "", [pid 5830] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5898] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] <... umount2 resumed>) = 0 [pid 5898] <... openat resumed>) = 3 [pid 5833] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] getdents64(3, [pid 5830] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5898] write(3, "1000", 4 [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5898] <... write resumed>) = 4 [pid 5831] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] newfstatat(AT_FDCWD, "./4/file1", [pid 5898] close(3 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5898] <... close resumed>) = 0 [pid 5833] <... umount2 resumed>) = 0 [pid 5830] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5898] symlink("/dev/binderfs", "./binderfs" [pid 5833] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5898] <... symlink resumed>) = 0 executing program [pid 5891] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5898] write(1, "executing program\n", 18 [pid 5830] <... openat resumed>) = 4 [pid 5898] <... write resumed>) = 18 [pid 5891] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] newfstatat(AT_FDCWD, "./4/file1", [pid 5830] newfstatat(4, "", [pid 5898] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5891] <... futex resumed>) = 1 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5898] <... futex resumed>) = 0 [pid 5895] <... futex resumed>) = 0 [pid 5891] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] getdents64(4, [pid 5898] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5898] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5895] mkdir("./file2", 0777 [pid 5833] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5898] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5830] getdents64(4, [pid 5898] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5898] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5898] <... mmap resumed>) = 0x7f476940f000 [pid 5830] close(4 [pid 5898] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5830] <... close resumed>) = 0 [pid 5898] <... mprotect resumed>) = 0 [pid 5830] rmdir("./4/file1" [pid 5898] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5830] <... rmdir resumed>) = 0 [pid 5898] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5898] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 5899 attached => {parent_tid=[5899]}, 88) = 5899 [pid 5899] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5898] rt_sigprocmask(SIG_SETMASK, [], [pid 5899] <... rseq resumed>) = 0 [pid 5898] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5830] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5899] set_robust_list(0x7f476942f9a0, 24 [pid 5898] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... openat resumed>) = 4 [pid 5899] <... set_robust_list resumed>) = 0 [pid 5898] <... futex resumed>) = 0 [pid 5833] newfstatat(4, "", [pid 5899] rt_sigprocmask(SIG_SETMASK, [], [pid 5898] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5899] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5899] memfd_create("syzkaller", 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5899] <... memfd_create resumed>) = 3 [pid 5833] getdents64(4, [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5899] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] unlink("./4/binderfs" [pid 5833] getdents64(4, [pid 5899] <... mmap resumed>) = 0x7f4761000000 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5831] <... umount2 resumed>) = 0 [pid 5833] close(4 [pid 5831] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] <... close resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] rmdir("./4/file1" [pid 5831] newfstatat(AT_FDCWD, "./5/file1", [pid 5899] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5833] <... rmdir resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] <... unlink resumed>) = 0 [pid 5833] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5831] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5899] <... write resumed>) = 131072 [pid 5833] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] <... openat resumed>) = 4 [pid 5833] unlink("./4/binderfs" [pid 5831] newfstatat(4, "", [pid 5830] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5830] close(3 [pid 5833] <... unlink resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] <... close resumed>) = 0 [pid 5899] munmap(0x7f4761000000, 138412032 [pid 5833] getdents64(3, [pid 5831] getdents64(4, [pid 5830] rmdir("./4" [pid 5899] <... munmap resumed>) = 0 [pid 5830] <... rmdir resumed>) = 0 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] mkdir("./5", 0777 [pid 5891] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5833] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] getdents64(4, [pid 5830] <... mkdir resumed>) = 0 [pid 5899] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5891] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] close(3 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5899] <... openat resumed>) = 4 [pid 5833] <... close resumed>) = 0 [pid 5830] <... openat resumed>) = 3 [pid 5899] ioctl(4, LOOP_SET_FD, 3 [pid 5891] <... futex resumed>) = 0 [pid 5833] rmdir("./4" [pid 5831] close(4 [pid 5899] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5831] <... close resumed>) = 0 [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5899] ioctl(4, LOOP_CLR_FD [pid 5830] <... ioctl resumed>) = 0 [pid 5891] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5831] rmdir("./5/file1" [pid 5899] <... ioctl resumed>) = 0 [pid 5830] close(3 [pid 5891] <... mmap resumed>) = 0x7f47693ee000 [pid 5833] mkdir("./5", 0777 [pid 5831] <... rmdir resumed>) = 0 [pid 5830] <... close resumed>) = 0 [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5891] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5833] <... mkdir resumed>) = 0 [pid 5831] umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5891] <... mprotect resumed>) = 0 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5900 attached [pid 5891] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5831] newfstatat(AT_FDCWD, "./5/binderfs", [pid 5833] <... openat resumed>) = 3 [pid 5900] set_robust_list(0x5555612166a0, 24 [pid 5891] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5899] ioctl(4, LOOP_SET_FD, 3 [pid 5831] unlink("./5/binderfs" [pid 5833] <... ioctl resumed>) = 0 [pid 5900] <... set_robust_list resumed>) = 0 [pid 5899] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5891] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5900] chdir("./5" [pid 5899] close(4 [pid 5833] close(3 [pid 5831] <... unlink resumed>) = 0 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5900 [pid 5900] <... chdir resumed>) = 0 [pid 5899] <... close resumed>) = 0 [pid 5833] <... close resumed>) = 0 ./strace-static-x86_64: Process 5901 attached [pid 5899] close(3 [ 99.888173][ T5895] exFAT-fs (loop0): error, data size is invalid(9000) [ 99.926744][ T5895] exFAT-fs (loop0): Filesystem has been set read-only [pid 5891] <... clone3 resumed> => {parent_tid=[5901]}, 88) = 5901 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5831] getdents64(3, [pid 5901] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5900] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5895] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5891] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5902 attached [pid 5901] <... rseq resumed>) = 0 [pid 5900] <... prctl resumed>) = 0 [pid 5899] <... close resumed>) = 0 [pid 5895] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5891] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5902] set_robust_list(0x5555612166a0, 24 [pid 5901] set_robust_list(0x7f476940e9a0, 24 [pid 5900] setpgid(0, 0 [pid 5902] <... set_robust_list resumed>) = 0 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5902 [pid 5831] close(3 [pid 5900] <... setpgid resumed>) = 0 [pid 5902] chdir("./5" [pid 5901] <... set_robust_list resumed>) = ? [pid 5900] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5831] <... close resumed>) = 0 [pid 5901] +++ killed by SIGSEGV +++ [pid 5900] <... openat resumed>) = 3 [pid 5899] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5902] <... chdir resumed>) = 0 [pid 5900] write(3, "1000", 4 [pid 5899] <... futex resumed>) = 1 [pid 5898] <... futex resumed>) = 0 [pid 5895] +++ killed by SIGSEGV +++ [pid 5891] +++ killed by SIGSEGV +++ [pid 5831] rmdir("./5" [pid 5902] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5898] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5902] <... prctl resumed>) = 0 [pid 5900] <... write resumed>) = 4 [pid 5899] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5898] <... futex resumed>) = 0 [pid 5831] <... rmdir resumed>) = 0 [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5891, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5902] setpgid(0, 0 [pid 5900] close(3 [pid 5899] <... openat resumed>) = 3 [pid 5898] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] mkdir("./6", 0777 [pid 5829] restart_syscall(<... resuming interrupted clone ...> [pid 5902] <... setpgid resumed>) = 0 [pid 5900] <... close resumed>) = 0 [pid 5902] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5900] symlink("/dev/binderfs", "./binderfs" [pid 5829] <... restart_syscall resumed>) = 0 [pid 5902] <... openat resumed>) = 3 [pid 5902] write(3, "1000", 4 [pid 5829] umount2("./4", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5829] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5829] newfstatat(3, "", [pid 5899] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5899] <... futex resumed>) = 1 [pid 5898] <... futex resumed>) = 0 [pid 5829] getdents64(3, [pid 5898] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5899] mkdir("./file2", 0777 [pid 5898] <... futex resumed>) = 0 [pid 5829] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5902] <... write resumed>) = 4 [pid 5899] <... mkdir resumed>) = 0 [pid 5898] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... mkdir resumed>) = 0 executing program [pid 5900] <... symlink resumed>) = 0 [pid 5900] write(1, "executing program\n", 18 [pid 5899] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5900] <... write resumed>) = 18 [pid 5902] close(3 [pid 5900] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5898] <... futex resumed>) = ? [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5902] <... close resumed>) = 0 [pid 5900] <... futex resumed>) = 0 executing program [pid 5829] <... umount2 resumed>) = 0 [pid 5902] symlink("/dev/binderfs", "./binderfs" [pid 5900] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5831] <... openat resumed>) = 3 [pid 5829] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5900] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5900] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5902] <... symlink resumed>) = 0 [pid 5900] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5902] write(1, "executing program\n", 18 [pid 5900] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5829] newfstatat(AT_FDCWD, "./4/file1", [pid 5902] <... write resumed>) = 18 [pid 5900] <... mmap resumed>) = 0x7f476940f000 [pid 5831] <... ioctl resumed>) = 0 [pid 5902] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5900] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5831] close(3 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5902] <... futex resumed>) = 0 [pid 5900] <... mprotect resumed>) = 0 [pid 5899] +++ killed by SIGSEGV +++ [pid 5898] +++ killed by SIGSEGV +++ [pid 5831] <... close resumed>) = 0 [pid 5829] umount2("./4/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5898, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=0} --- [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5902] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5900] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5902] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5902] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5900] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5900] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 5904 attached ./strace-static-x86_64: Process 5903 attached [pid 5902] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... openat resumed>) = 4 [pid 5904] set_robust_list(0x5555612166a0, 24 [pid 5903] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5902] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5900] <... clone3 resumed> => {parent_tid=[5903]}, 88) = 5903 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] newfstatat(4, "", [pid 5902] <... mmap resumed>) = 0x7f476940f000 [pid 5902] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5900] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5902] <... mprotect resumed>) = 0 [pid 5829] getdents64(4, [pid 5900] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... openat resumed>) = 3 [pid 5902] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5900] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] newfstatat(3, "", [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5900] <... futex resumed>) = 0 [pid 5900] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] getdents64(3, 0x555561217730 /* 5 entries */, 32768) = 144 [pid 5903] <... rseq resumed>) = 0 [pid 5902] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5832] umount2("./5/devices.list", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5905 attached [pid 5903] set_robust_list(0x7f476942f9a0, 24 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5903] <... set_robust_list resumed>) = 0 [pid 5902] <... clone3 resumed> => {parent_tid=[5905]}, 88) = 5905 [pid 5832] newfstatat(AT_FDCWD, "./5/devices.list", [pid 5903] rt_sigprocmask(SIG_SETMASK, [], [pid 5902] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5903] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5902] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] unlink("./5/devices.list" [pid 5829] getdents64(4, [pid 5904] <... set_robust_list resumed>) = 0 [pid 5903] memfd_create("syzkaller", 0 [pid 5902] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... unlink resumed>) = 0 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5904 [pid 5902] <... futex resumed>) = 0 [pid 5832] umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5902] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./5/binderfs", [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5905] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5904] chdir("./6" [pid 5903] <... memfd_create resumed>) = 3 [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5905] <... rseq resumed>) = 0 [pid 5903] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5832] unlink("./5/binderfs" [pid 5905] set_robust_list(0x7f476942f9a0, 24 [pid 5904] <... chdir resumed>) = 0 [pid 5903] <... mmap resumed>) = 0x7f4761000000 [pid 5832] <... unlink resumed>) = 0 [pid 5829] close(4 [pid 5904] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5905] <... set_robust_list resumed>) = 0 [pid 5904] <... prctl resumed>) = 0 [pid 5903] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5832] umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... close resumed>) = 0 [pid 5905] rt_sigprocmask(SIG_SETMASK, [], [pid 5904] setpgid(0, 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5905] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] newfstatat(AT_FDCWD, "./5/file2", [pid 5905] memfd_create("syzkaller", 0 [pid 5904] <... setpgid resumed>) = 0 [pid 5829] rmdir("./4/file1" [pid 5905] <... memfd_create resumed>) = 3 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5905] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5904] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5832] umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5905] <... mmap resumed>) = 0x7f4761000000 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5905] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5904] <... openat resumed>) = 3 [pid 5832] openat(AT_FDCWD, "./5/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] <... rmdir resumed>) = 0 [pid 5905] <... write resumed>) = 131072 [pid 5904] write(3, "1000", 4 [pid 5903] <... write resumed>) = 131072 [pid 5832] <... openat resumed>) = 4 [pid 5832] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5904] <... write resumed>) = 4 [pid 5903] munmap(0x7f4761000000, 138412032 [pid 5832] getdents64(4, executing program [pid 5829] umount2("./4/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5904] close(3 [pid 5903] <... munmap resumed>) = 0 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5904] <... close resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5905] munmap(0x7f4761000000, 138412032 [pid 5904] symlink("/dev/binderfs", "./binderfs" [pid 5832] getdents64(4, [pid 5905] <... munmap resumed>) = 0 [pid 5904] <... symlink resumed>) = 0 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] newfstatat(AT_FDCWD, "./4/binderfs", [pid 5904] write(1, "executing program\n", 18 [pid 5832] close(4 [pid 5904] <... write resumed>) = 18 [pid 5832] <... close resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5904] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5903] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5832] rmdir("./5/file2" [pid 5829] unlink("./4/binderfs" [pid 5905] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5904] <... futex resumed>) = 0 [pid 5903] <... openat resumed>) = 4 [pid 5832] <... rmdir resumed>) = 0 [pid 5829] <... unlink resumed>) = 0 [pid 5905] <... openat resumed>) = 4 [pid 5904] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5905] ioctl(4, LOOP_SET_FD, 3 [pid 5832] getdents64(3, [pid 5905] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5903] ioctl(4, LOOP_SET_FD, 3 [pid 5832] close(3 [pid 5905] ioctl(4, LOOP_CLR_FD [pid 5903] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5832] <... close resumed>) = 0 [pid 5905] <... ioctl resumed>) = 0 [pid 5903] ioctl(4, LOOP_CLR_FD [pid 5832] rmdir("./5" [pid 5904] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5903] <... ioctl resumed>) = 0 [pid 5904] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5829] getdents64(3, [pid 5904] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5904] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5904] <... mmap resumed>) = 0x7f476940f000 [pid 5829] close(3 [pid 5904] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5832] <... rmdir resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 5832] mkdir("./6", 0777 [pid 5904] <... mprotect resumed>) = 0 [pid 5829] rmdir("./4" [pid 5905] ioctl(4, LOOP_SET_FD, 3 [pid 5904] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] <... mkdir resumed>) = 0 [pid 5905] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5829] <... rmdir resumed>) = 0 [pid 5905] close(4) = 0 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 5832] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 5832] close(3) = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5904] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5829] mkdir("./5", 0777 [pid 5904] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 5906 attached [pid 5905] close(3 [pid 5903] ioctl(4, LOOP_SET_FD, 3 [pid 5829] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5907 attached [pid 5906] set_robust_list(0x5555612166a0, 24 [pid 5905] <... close resumed>) = 0 [pid 5903] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5906 [pid 5907] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5906] <... set_robust_list resumed>) = 0 [pid 5904] <... clone3 resumed> => {parent_tid=[5907]}, 88) = 5907 [pid 5903] close(4 [pid 5907] <... rseq resumed>) = 0 [pid 5907] set_robust_list(0x7f476942f9a0, 24 [pid 5905] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5904] rt_sigprocmask(SIG_SETMASK, [], [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5906] chdir("./6" [pid 5905] <... futex resumed>) = 1 [pid 5902] <... futex resumed>) = 0 [pid 5902] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5906] <... chdir resumed>) = 0 [pid 5905] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5902] <... futex resumed>) = 0 [pid 5906] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5905] <... openat resumed>) = 3 [pid 5902] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5906] <... prctl resumed>) = 0 [pid 5905] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5906] setpgid(0, 0 [pid 5905] <... futex resumed>) = 1 [pid 5902] <... futex resumed>) = 0 [pid 5906] <... setpgid resumed>) = 0 [pid 5905] mkdir("./file2", 0777 [pid 5902] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5907] <... set_robust_list resumed>) = 0 [pid 5906] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5905] <... mkdir resumed>) = 0 [pid 5904] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5902] <... futex resumed>) = 0 [pid 5829] <... openat resumed>) = 3 [pid 5907] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5906] <... openat resumed>) = 3 [pid 5904] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5902] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5829] ioctl(3, LOOP_CLR_FD [pid 5905] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5904] <... futex resumed>) = 0 [pid 5902] <... futex resumed>) = ? [pid 5907] memfd_create("syzkaller", 0 [pid 5905] +++ killed by SIGSEGV +++ [pid 5904] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5903] <... close resumed>) = 0 [pid 5902] +++ killed by SIGSEGV +++ [pid 5829] <... ioctl resumed>) = 0 [pid 5907] <... memfd_create resumed>) = 3 [pid 5906] write(3, "1000", 4 [pid 5903] close(3 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5902, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5907] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5829] close(3executing program [pid 5907] <... mmap resumed>) = 0x7f4761000000 [pid 5906] <... write resumed>) = 4 [pid 5903] <... close resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5833] umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5903] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5906] close(3 [pid 5903] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5906] <... close resumed>) = 0 [pid 5907] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5833] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5906] symlink("/dev/binderfs", "./binderfs" [pid 5833] <... openat resumed>) = 3 [pid 5906] <... symlink resumed>) = 0 [pid 5833] newfstatat(3, "", [pid 5900] <... futex resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5900] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] getdents64(3, [pid 5906] write(1, "executing program\n", 18 [pid 5903] <... futex resumed>) = 0 [pid 5900] <... futex resumed>) = 1 [pid 5833] <... getdents64 resumed>0x555561217730 /* 5 entries */, 32768) = 144 [pid 5906] <... write resumed>) = 18 [pid 5903] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5900] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5907] <... write resumed>) = 131072 [pid 5833] umount2("./5/devices.list", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5908 [pid 5906] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5903] <... openat resumed>) = 3 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5906] <... futex resumed>) = 0 [pid 5903] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] newfstatat(AT_FDCWD, "./5/devices.list", [pid 5906] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5903] <... futex resumed>) = 1 [pid 5900] <... futex resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5906] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5903] mkdir("./file2", 0777 [pid 5900] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] unlink("./5/devices.list"./strace-static-x86_64: Process 5908 attached [pid 5907] munmap(0x7f4761000000, 138412032 [pid 5906] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5903] <... mkdir resumed>) = 0 [pid 5900] <... futex resumed>) = 0 [pid 5833] <... unlink resumed>) = 0 [pid 5900] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5908] set_robust_list(0x5555612166a0, 24 [pid 5907] <... munmap resumed>) = 0 [pid 5906] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5908] <... set_robust_list resumed>) = 0 [pid 5906] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] newfstatat(AT_FDCWD, "./5/binderfs", [pid 5906] <... mmap resumed>) = 0x7f476940f000 [pid 5833] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5906] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5833] unlink("./5/binderfs" [pid 5906] <... mprotect resumed>) = 0 [pid 5903] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5833] <... unlink resumed>) = 0 [pid 5908] chdir("./5" [pid 5906] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5900] <... futex resumed>) = ? [pid 5833] umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5908] <... chdir resumed>) = 0 [pid 5907] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5906] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5903] +++ killed by SIGSEGV +++ [pid 5900] +++ killed by SIGSEGV +++ [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5908] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5907] <... openat resumed>) = 4 [pid 5906] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5833] newfstatat(AT_FDCWD, "./5/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5906] <... clone3 resumed> => {parent_tid=[5909]}, 88) = 5909 [pid 5833] umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5900, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5906] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5909 attached [pid 5906] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] openat(AT_FDCWD, "./5/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5908] <... prctl resumed>) = 0 [pid 5907] ioctl(4, LOOP_SET_FD, 3 [pid 5906] <... futex resumed>) = 0 [pid 5833] <... openat resumed>) = 4 [pid 5830] umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5909] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5908] setpgid(0, 0 [pid 5907] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5906] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5833] newfstatat(4, "", [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5909] <... rseq resumed>) = 0 [pid 5908] <... setpgid resumed>) = 0 [pid 5907] ioctl(4, LOOP_CLR_FD [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5909] set_robust_list(0x7f476942f9a0, 24 [pid 5908] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5907] <... ioctl resumed>) = 0 [pid 5833] getdents64(4, [pid 5909] <... set_robust_list resumed>) = 0 [pid 5908] <... openat resumed>) = 3 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] <... openat resumed>) = 3 [pid 5908] write(3, "1000", 4 [pid 5830] newfstatat(3, "", [pid 5909] rt_sigprocmask(SIG_SETMASK, [], [pid 5908] <... write resumed>) = 4 [pid 5833] getdents64(4, [pid 5909] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5908] close(3 [pid 5907] ioctl(4, LOOP_SET_FD, 3 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5909] memfd_create("syzkaller", 0 [pid 5908] <... close resumed>) = 0 [pid 5907] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5833] close(4 [pid 5830] getdents64(3, [pid 5909] <... memfd_create resumed>) = 3 [pid 5908] symlink("/dev/binderfs", "./binderfs" [pid 5907] close(4 [pid 5833] <... close resumed>) = 0 [pid 5830] <... getdents64 resumed>0x555561217730 /* 5 entries */, 32768) = 144 [pid 5909] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5907] <... close resumed>) = 0 [pid 5833] rmdir("./5/file2" [pid 5830] umount2("./5/devices.list", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5909] <... mmap resumed>) = 0x7f4761000000 [pid 5908] <... symlink resumed>) = 0 [pid 5907] close(3 [pid 5833] <... rmdir resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) executing program [pid 5909] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5830] newfstatat(AT_FDCWD, "./5/devices.list", [pid 5907] <... close resumed>) = 0 [pid 5833] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5908] write(1, "executing program\n", 18 [pid 5907] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] close(3 [pid 5830] unlink("./5/devices.list" [pid 5908] <... write resumed>) = 18 [pid 5907] <... futex resumed>) = 1 [pid 5904] <... futex resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 5830] <... unlink resumed>) = 0 [pid 5909] <... write resumed>) = 131072 [pid 5908] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5907] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5904] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] rmdir("./5" [pid 5908] <... futex resumed>) = 0 [pid 5904] <... futex resumed>) = 0 [pid 5830] umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5908] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5904] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5909] munmap(0x7f4761000000, 138412032 [pid 5908] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5907] <... openat resumed>) = 3 [pid 5833] <... rmdir resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5909] <... munmap resumed>) = 0 [pid 5908] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5907] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] newfstatat(AT_FDCWD, "./5/binderfs", [pid 5909] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5908] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5907] <... futex resumed>) = 1 [pid 5904] <... futex resumed>) = 0 [pid 5909] <... openat resumed>) = 4 [pid 5908] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5907] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5904] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5909] ioctl(4, LOOP_SET_FD, 3 [pid 5908] <... mmap resumed>) = 0x7f476940f000 [pid 5907] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5904] <... futex resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] mkdir("./6", 0777 [pid 5904] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] unlink("./5/binderfs") = 0 [pid 5908] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5907] mkdir("./file2", 0777 [pid 5833] <... mkdir resumed>) = 0 [pid 5830] umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5907] <... mkdir resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5908] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5907] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5830] newfstatat(AT_FDCWD, "./5/file2", [pid 5904] <... futex resumed>) = ? [pid 5908] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5908] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} => {parent_tid=[5910]}, 88) = 5910 ./strace-static-x86_64: Process 5910 attached [pid 5908] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5830] umount2("./5/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5910] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5908] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] <... openat resumed>) = 3 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5830] openat(AT_FDCWD, "./5/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5910] <... rseq resumed>) = 0 [pid 5908] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5910] set_robust_list(0x7f476942f9a0, 24 [pid 5908] <... futex resumed>) = 0 [pid 5910] <... set_robust_list resumed>) = 0 [pid 5908] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5910] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5910] memfd_create("syzkaller", 0) = 3 [pid 5907] +++ killed by SIGSEGV +++ [pid 5904] +++ killed by SIGSEGV +++ [pid 5833] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5830] <... openat resumed>) = 4 [pid 5910] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5833] close(3 [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5904, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5830] newfstatat(4, "", [pid 5910] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5831] restart_syscall(<... resuming interrupted clone ...> [pid 5833] <... close resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5831] <... restart_syscall resumed>) = 0 ./strace-static-x86_64: Process 5911 attached [pid 5910] <... write resumed>) = 131072 [pid 5830] getdents64(4, [pid 5910] munmap(0x7f4761000000, 138412032 [pid 5831] umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5910] <... munmap resumed>) = 0 [pid 5909] <... ioctl resumed>) = 0 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5911] set_robust_list(0x5555612166a0, 24 [pid 5831] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5909] close(3 [pid 5830] getdents64(4, [pid 5911] <... set_robust_list resumed>) = 0 [pid 5910] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5909] <... close resumed>) = 0 [pid 5831] <... openat resumed>) = 3 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5911] chdir("./6" [pid 5910] <... openat resumed>) = 4 [pid 5909] close(4 [pid 5911] <... chdir resumed>) = 0 [pid 5910] ioctl(4, LOOP_SET_FD, 3 [pid 5911] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5909] <... close resumed>) = 0 [pid 5831] newfstatat(3, "", [pid 5830] close(4 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] <... close resumed>) = 0 [ 100.304140][ T5909] loop3: detected capacity change from 0 to 256 [pid 5911] <... prctl resumed>) = 0 [pid 5909] mkdir("./file1", 0777 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5911 [pid 5831] getdents64(3, [pid 5830] rmdir("./5/file2" [pid 5911] setpgid(0, 0) = 0 [pid 5911] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5909] <... mkdir resumed>) = 0 [pid 5911] write(3, "1000", 4 [pid 5830] <... rmdir resumed>) = 0 [pid 5911] <... write resumed>) = 4 [pid 5831] <... getdents64 resumed>0x555561217730 /* 5 entries */, 32768) = 144 [pid 5830] getdents64(3, [pid 5831] umount2("./6/devices.list", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5909] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5911] close(3) = 0 [pid 5911] symlink("/dev/binderfs", "./binderfs"executing program ) = 0 [pid 5911] write(1, "executing program\n", 18) = 18 [pid 5831] newfstatat(AT_FDCWD, "./6/devices.list", [pid 5830] close(3 [pid 5911] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5911] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5830] <... close resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5911] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5911] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5911] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 5911] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5831] unlink("./6/devices.list" [pid 5830] rmdir("./5" [pid 5831] <... unlink resumed>) = 0 [pid 5830] <... rmdir resumed>) = 0 [pid 5831] umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] mkdir("./6", 0777 [pid 5911] <... mprotect resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... mkdir resumed>) = 0 [pid 5831] newfstatat(AT_FDCWD, "./6/binderfs", [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5911] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] <... openat resumed>) = 3 [pid 5831] unlink("./6/binderfs" [pid 5830] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 5911] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5830] close(3 [pid 5911] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5831] <... unlink resumed>) = 0 [pid 5830] <... close resumed>) = 0 [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5912 attached ./strace-static-x86_64: Process 5913 attached [pid 5912] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5910] <... ioctl resumed>) = 0 [pid 5831] umount2("./6/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5913] set_robust_list(0x5555612166a0, 24 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5913 [pid 5913] <... set_robust_list resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 100.365721][ T5910] loop0: detected capacity change from 0 to 256 [pid 5913] chdir("./6" [pid 5912] <... rseq resumed>) = 0 [pid 5911] <... clone3 resumed> => {parent_tid=[5912]}, 88) = 5912 [pid 5831] newfstatat(AT_FDCWD, "./6/file2", [pid 5913] <... chdir resumed>) = 0 [pid 5913] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5912] set_robust_list(0x7f476942f9a0, 24 [pid 5911] rt_sigprocmask(SIG_SETMASK, [], [pid 5913] <... prctl resumed>) = 0 [pid 5912] <... set_robust_list resumed>) = 0 [pid 5911] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5913] setpgid(0, 0 [pid 5912] rt_sigprocmask(SIG_SETMASK, [], [pid 5911] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5910] close(3 [pid 5831] umount2("./6/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5913] <... setpgid resumed>) = 0 [pid 5910] <... close resumed>) = 0 [pid 5913] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5912] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5911] <... futex resumed>) = 0 [pid 5912] memfd_create("syzkaller", 0 [pid 5911] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5910] close(4 [pid 5912] <... memfd_create resumed>) = 3 [pid 5910] <... close resumed>) = 0 [pid 5912] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5910] mkdir("./file1", 0777) = 0 [pid 5912] <... mmap resumed>) = 0x7f4761000000 [pid 5913] <... openat resumed>) = 3 [pid 5912] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5910] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5912] <... write resumed>) = 131072 [pid 5912] munmap(0x7f4761000000, 138412032 [pid 5913] write(3, "1000", 4 [pid 5912] <... munmap resumed>) = 0 [pid 5913] <... write resumed>) = 4 [pid 5912] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5912] <... openat resumed>) = 4 [pid 5912] ioctl(4, LOOP_SET_FD, 3 [pid 5913] close(3 [pid 5831] openat(AT_FDCWD, "./6/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5913] <... close resumed>) = 0 [pid 5831] <... openat resumed>) = 4 [pid 5831] newfstatat(4, "", [ 100.409472][ T5909] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 100.441852][ T5912] loop4: detected capacity change from 0 to 256 [pid 5913] symlink("/dev/binderfs", "./binderfs"executing program ) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5913] write(1, "executing program\n", 18 [pid 5831] getdents64(4, [pid 5913] <... write resumed>) = 18 [pid 5913] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5912] <... ioctl resumed>) = 0 [pid 5909] <... mount resumed>) = 0 [pid 5912] close(3 [pid 5909] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5912] <... close resumed>) = 0 [pid 5909] <... openat resumed>) = 3 [pid 5912] close(4 [pid 5909] chdir("./file1" [pid 5912] <... close resumed>) = 0 [pid 5909] <... chdir resumed>) = 0 [pid 5912] mkdir("./file1", 0777 [pid 5909] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5913] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5912] <... mkdir resumed>) = 0 [pid 5909] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5909] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5909] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5912] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] getdents64(4, [pid 5913] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5906] <... futex resumed>) = 0 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5906] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5913] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5906] <... futex resumed>) = 1 [pid 5913] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5906] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5913] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5909] <... futex resumed>) = 0 [pid 5831] close(4 [pid 5909] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5831] <... close resumed>) = 0 [pid 5831] rmdir("./6/file2" [pid 5913] <... mmap resumed>) = 0x7f476940f000 [pid 5831] <... rmdir resumed>) = 0 [pid 5913] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5831] getdents64(3, [pid 5913] <... mprotect resumed>) = 0 [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5913] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5831] close(3 [pid 5909] <... openat resumed>) = 4 [pid 5831] <... close resumed>) = 0 [pid 5909] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] rmdir("./6" [pid 5909] <... futex resumed>) = 1 [pid 5906] <... futex resumed>) = 0 [pid 5831] <... rmdir resumed>) = 0 [ 100.461386][ T5910] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5906] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5909] mkdir("./file2", 0777 [pid 5906] <... futex resumed>) = 0 [pid 5831] mkdir("./7", 0777 [pid 5913] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5906] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... mkdir resumed>) = 0 [pid 5913] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR./strace-static-x86_64: Process 5914 attached ) = 3 [pid 5914] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5913] <... clone3 resumed> => {parent_tid=[5914]}, 88) = 5914 [pid 5910] <... mount resumed>) = 0 [pid 5914] <... rseq resumed>) = 0 [pid 5913] rt_sigprocmask(SIG_SETMASK, [], [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5914] set_robust_list(0x7f476942f9a0, 24 [pid 5913] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5914] <... set_robust_list resumed>) = 0 [pid 5913] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5831] close(3) = 0 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5914] rt_sigprocmask(SIG_SETMASK, [], [pid 5913] <... futex resumed>) = 0 [pid 5914] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5913] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5914] memfd_create("syzkaller", 0 [pid 5910] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5910] chdir("./file1") = 0 [ 100.513343][ T5909] exFAT-fs (loop3): error, data size is invalid(9000) [ 100.530000][ T5912] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5910] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5914] <... memfd_create resumed>) = 3 [pid 5910] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5906] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5914] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5906] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5914] <... mmap resumed>) = 0x7f4761000000 [pid 5906] <... futex resumed>) = 0 [pid 5906] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5906] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 5915 attached ) = 0 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5915 [pid 5906] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5906] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5915] set_robust_list(0x5555612166a0, 24 [pid 5910] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5915] <... set_robust_list resumed>) = 0 [pid 5910] <... futex resumed>) = 1 ./strace-static-x86_64: Process 5916 attached [pid 5915] chdir("./7" [pid 5906] <... clone3 resumed> => {parent_tid=[5916]}, 88) = 5916 [pid 5910] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5908] <... futex resumed>) = 0 [pid 5915] <... chdir resumed>) = 0 [pid 5908] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5908] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5910] <... futex resumed>) = 0 [pid 5910] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5915] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5915] setpgid(0, 0) = 0 [pid 5915] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5910] <... openat resumed>) = 4 [pid 5915] write(3, "1000", 4) = 4 [pid 5910] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5915] close(3 [pid 5910] <... futex resumed>) = 1 [pid 5908] <... futex resumed>) = 0 [pid 5915] <... close resumed>) = 0 [pid 5910] mkdir("./file2", 0777 [pid 5908] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5916] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5915] symlink("/dev/binderfs", "./binderfs" [pid 5914] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5908] <... futex resumed>) = 0 [pid 5906] rt_sigprocmask(SIG_SETMASK, [], [pid 5915] <... symlink resumed>) = 0 [pid 5908] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}executing program [pid 5915] write(1, "executing program\n", 18) = 18 [pid 5915] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5915] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 5915] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5912] <... mount resumed>) = 0 [pid 5915] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5912] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5915] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5912] <... openat resumed>) = 3 [pid 5912] chdir("./file1") = 0 [pid 5912] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5915] <... mmap resumed>) = 0x7f476940f000 [pid 5912] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5912] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5915] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5911] <... futex resumed>) = 0 [pid 5916] <... rseq resumed>) = 0 [pid 5906] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5915] <... mprotect resumed>) = 0 [pid 5911] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5909] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5915] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5914] <... write resumed>) = 131072 [pid 5912] <... futex resumed>) = 0 [pid 5911] <... futex resumed>) = 1 [pid 5909] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5906] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5916] set_robust_list(0x7f476940e9a0, 24 [pid 5915] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5912] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5911] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5915] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} => {parent_tid=[5917]}, 88) = 5917 [pid 5915] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5915] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5915] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5917 attached [pid 5917] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5912] <... openat resumed>) = 4 [ 100.567922][ T5909] exFAT-fs (loop3): Filesystem has been set read-only [ 100.594421][ T5910] exFAT-fs (loop0): error, data size is invalid(9000) [ 100.602065][ T5910] exFAT-fs (loop0): Filesystem has been set read-only [pid 5917] <... rseq resumed>) = 0 [pid 5912] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5916] <... set_robust_list resumed>) = ? [pid 5906] <... futex resumed>) = ? [pid 5917] set_robust_list(0x7f476942f9a0, 24 [pid 5912] <... futex resumed>) = 1 [pid 5911] <... futex resumed>) = 0 [pid 5916] +++ killed by SIGSEGV +++ [pid 5917] <... set_robust_list resumed>) = 0 [pid 5912] mkdir("./file2", 0777 [pid 5911] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5917] rt_sigprocmask(SIG_SETMASK, [], [pid 5911] <... futex resumed>) = 0 [pid 5917] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5911] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5917] memfd_create("syzkaller", 0 [pid 5914] munmap(0x7f4761000000, 138412032 [pid 5917] <... memfd_create resumed>) = 3 [pid 5917] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5914] <... munmap resumed>) = 0 [pid 5917] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 5917] munmap(0x7f4761000000, 138412032) = 0 [pid 5917] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 5910] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5917] ioctl(4, LOOP_SET_FD, 3 [pid 5914] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5908] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5908] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5908] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5908] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5908] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5908] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} => {parent_tid=[5918]}, 88) = 5918 [pid 5914] <... openat resumed>) = 4 [pid 5909] +++ killed by SIGSEGV +++ [pid 5908] rt_sigprocmask(SIG_SETMASK, [], [pid 5906] +++ killed by SIGSEGV +++ [pid 5914] ioctl(4, LOOP_SET_FD, 3 [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5906, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- ./strace-static-x86_64: Process 5918 attached [pid 5910] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5908] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 100.634843][ T5912] exFAT-fs (loop4): error, data size is invalid(9000) [ 100.658269][ T5912] exFAT-fs (loop4): Filesystem has been set read-only [ 100.672259][ T5917] loop2: detected capacity change from 0 to 256 [pid 5910] +++ killed by SIGSEGV +++ [pid 5918] +++ killed by SIGSEGV +++ [pid 5908] +++ killed by SIGSEGV +++ [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5908, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5829] restart_syscall(<... resuming interrupted clone ...> [pid 5917] <... ioctl resumed>) = 0 [pid 5912] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5911] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5829] <... restart_syscall resumed>) = 0 [pid 5911] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5917] close(3 [pid 5912] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5911] <... futex resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5911] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5829] umount2("./5", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5911] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5911] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5829] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5911] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] <... openat resumed>) = 3 [pid 5911] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5829] newfstatat(3, "", ./strace-static-x86_64: Process 5919 attached {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5911] <... clone3 resumed> => {parent_tid=[5919]}, 88) = 5919 [pid 5829] getdents64(3, [pid 5911] rt_sigprocmask(SIG_SETMASK, [], [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5911] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... openat resumed>) = 3 [pid 5829] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5911] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5919] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5911] <... futex resumed>) = 0 [pid 5919] <... rseq resumed>) = 0 [pid 5917] <... close resumed>) = 0 [pid 5911] read(1765863168, [pid 5832] newfstatat(3, "", [pid 5917] close(4 [pid 5919] +++ killed by SIGSEGV +++ [pid 5917] <... close resumed>) = 0 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5917] mkdir("./file1", 0777) = 0 [pid 5832] getdents64(3, [pid 5914] <... ioctl resumed>) = 0 [pid 5914] close(3 [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5914] <... close resumed>) = 0 [pid 5832] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [ 100.682642][ T5914] loop1: detected capacity change from 0 to 256 [pid 5914] close(4) = 0 [pid 5912] +++ killed by SIGSEGV +++ [pid 5911] +++ killed by SIGSEGV +++ [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5911, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5914] mkdir("./file1", 0777 [pid 5833] restart_syscall(<... resuming interrupted clone ...> [pid 5917] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5914] <... mkdir resumed>) = 0 [pid 5833] <... restart_syscall resumed>) = 0 [pid 5829] <... umount2 resumed>) = 0 [pid 5829] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] newfstatat(AT_FDCWD, "./5/file1", [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] umount2("./5/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] <... openat resumed>) = 3 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(3, "", [pid 5829] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] <... openat resumed>) = 4 [pid 5833] getdents64(3, [pid 5829] newfstatat(4, "", [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] close(4) = 0 [pid 5829] rmdir("./5/file1") = 0 [pid 5829] umount2("./5/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5914] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 5833] <... umount2 resumed>) = 0 [pid 5832] <... umount2 resumed>) = 0 [pid 5829] newfstatat(AT_FDCWD, "./5/binderfs", [pid 5832] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] unlink("./5/binderfs" [pid 5833] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] newfstatat(AT_FDCWD, "./6/file1", [pid 5829] <... unlink resumed>) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] getdents64(3, [pid 5832] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5833] newfstatat(AT_FDCWD, "./6/file1", [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] close(3 [pid 5832] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] <... close resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] <... openat resumed>) = 4 [pid 5829] rmdir("./5") = 0 [pid 5829] mkdir("./6", 0777 [pid 5833] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... mkdir resumed>) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(4, "", [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] <... openat resumed>) = 3 [pid 5832] getdents64(4, [pid 5829] ioctl(3, LOOP_CLR_FD [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] <... ioctl resumed>) = 0 [pid 5832] getdents64(4, [pid 5829] close(3 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5832] close(4) = 0 [pid 5832] rmdir("./6/file1" [pid 5833] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5832] <... rmdir resumed>) = 0 [pid 5832] umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] <... openat resumed>) = 4 [pid 5832] newfstatat(AT_FDCWD, "./6/binderfs", [pid 5833] newfstatat(4, "", [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] unlink("./6/binderfs" [pid 5829] <... close resumed>) = 0 [pid 5833] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5833] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5833] close(4) = 0 [pid 5833] rmdir("./6/file1") = 0 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5920 attached [pid 5833] umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 100.780265][ T5917] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5920] set_robust_list(0x5555612166a0, 24 [pid 5833] unlink("./6/binderfs" [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5920 [pid 5920] <... set_robust_list resumed>) = 0 [pid 5833] <... unlink resumed>) = 0 [pid 5833] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5833] close(3) = 0 [pid 5833] rmdir("./6") = 0 [pid 5832] <... unlink resumed>) = 0 [pid 5832] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] close(3) = 0 [pid 5832] rmdir("./6") = 0 [pid 5833] mkdir("./7", 0777 [pid 5832] mkdir("./7", 0777 [pid 5920] chdir("./6" [pid 5833] <... mkdir resumed>) = 0 [pid 5832] <... mkdir resumed>) = 0 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 5832] ioctl(3, LOOP_CLR_FD) = 0 [pid 5832] close(3 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 5833] ioctl(3, LOOP_CLR_FD) = 0 [pid 5833] close(3) = 0 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5920] <... chdir resumed>) = 0 [pid 5832] <... close resumed>) = 0 ./strace-static-x86_64: Process 5921 attached [pid 5920] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5921] set_robust_list(0x5555612166a0, 24 [pid 5920] setpgid(0, 0 [pid 5921] <... set_robust_list resumed>) = 0 [pid 5920] <... setpgid resumed>) = 0 [pid 5921] chdir("./7" [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5921 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5922 attached [pid 5921] <... chdir resumed>) = 0 [pid 5920] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5917] <... mount resumed>) = 0 [pid 5914] <... mount resumed>) = 0 [pid 5921] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5917] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5922 [pid 5921] setpgid(0, 0 [pid 5920] <... openat resumed>) = 3 [pid 5917] <... openat resumed>) = 3 [pid 5914] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5921] <... setpgid resumed>) = 0 [pid 5917] chdir("./file1" [pid 5914] <... openat resumed>) = 3 [pid 5922] set_robust_list(0x5555612166a0, 24 [pid 5921] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5920] write(3, "1000", 4 [pid 5917] <... chdir resumed>) = 0 [pid 5914] chdir("./file1" [pid 5921] <... openat resumed>) = 3 [pid 5920] <... write resumed>) = 4 [pid 5917] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5914] <... chdir resumed>) = 0 [pid 5922] <... set_robust_list resumed>) = 0 [pid 5921] write(3, "1000", 4 [pid 5920] close(3 [pid 5917] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5914] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5920] <... close resumed>) = 0 [pid 5922] chdir("./7" [pid 5921] <... write resumed>) = 4 [pid 5920] symlink("/dev/binderfs", "./binderfs" [pid 5917] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5914] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5922] <... chdir resumed>) = 0 [pid 5921] close(3 [pid 5920] <... symlink resumed>) = 0 [pid 5917] <... futex resumed>) = 1 [pid 5915] <... futex resumed>) = 0 [pid 5914] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5922] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5921] <... close resumed>) = 0 [pid 5920] write(1, "executing program\n", 18 [pid 5917] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULLexecuting program [ 100.875718][ T5914] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5915] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5914] <... futex resumed>) = 1 [pid 5913] <... futex resumed>) = 0 [pid 5922] <... prctl resumed>) = 0 [pid 5921] symlink("/dev/binderfs", "./binderfs" [pid 5920] <... write resumed>) = 18 [pid 5917] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5915] <... futex resumed>) = 0 [pid 5914] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5913] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5920] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5915] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5914] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5913] <... futex resumed>) = 0 [pid 5922] setpgid(0, 0 [pid 5920] <... futex resumed>) = 0 [pid 5917] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5914] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5913] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5922] <... setpgid resumed>) = 0 [pid 5921] <... symlink resumed>) = 0 [pid 5920] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, executing program [pid 5922] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5921] write(1, "executing program\n", 18 [pid 5920] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5917] <... openat resumed>) = 4 [pid 5914] <... openat resumed>) = 4 [pid 5922] <... openat resumed>) = 3 [pid 5921] <... write resumed>) = 18 [pid 5920] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5917] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5914] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5922] write(3, "1000", 4) = 4 [pid 5921] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5920] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5917] <... futex resumed>) = 1 [pid 5915] <... futex resumed>) = 0 [pid 5922] close(3 [pid 5921] <... futex resumed>) = 0 [pid 5920] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5917] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5915] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5914] <... futex resumed>) = 1 [pid 5913] <... futex resumed>) = 0 [pid 5922] <... close resumed>) = 0 [pid 5921] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5920] <... mmap resumed>) = 0x7f476940f000 [pid 5917] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5915] <... futex resumed>) = 0 [pid 5914] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5913] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5922] symlink("/dev/binderfs", "./binderfs" [pid 5921] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5920] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5917] mkdir("./file2", 0777 [pid 5915] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5914] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5913] <... futex resumed>) = 0 executing program [pid 5922] <... symlink resumed>) = 0 [pid 5921] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5914] mkdir("./file2", 0777 [pid 5913] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5922] write(1, "executing program\n", 18) = 18 [pid 5922] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5922] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 5922] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5922] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 5922] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5922] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5921] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5921] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5920] <... mprotect resumed>) = 0 [pid 5922] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5921] <... mmap resumed>) = 0x7f476940f000 [pid 5920] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 5923 attached [pid 5921] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5922] <... clone3 resumed> => {parent_tid=[5923]}, 88) = 5923 [pid 5922] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5922] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 100.966609][ T5917] exFAT-fs (loop2): error, data size is invalid(9000) [ 100.975071][ T5914] exFAT-fs (loop1): error, data size is invalid(9000) [pid 5922] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5923] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5921] <... mprotect resumed>) = 0 [pid 5920] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5915] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5913] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5913] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5913] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5920] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5915] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5913] <... mmap resumed>) = 0x7f47693ee000 [pid 5921] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5923] <... rseq resumed>) = 0 [pid 5913] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5913] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5913] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0}./strace-static-x86_64: Process 5924 attached [pid 5924] rseq(0x7f476940efe0, 0x20, 0, 0x53053053./strace-static-x86_64: Process 5925 attached ) = 0 [pid 5923] set_robust_list(0x7f476942f9a0, 24 [pid 5921] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5915] <... futex resumed>) = 0 [pid 5913] <... clone3 resumed> => {parent_tid=[5924]}, 88) = 5924 [pid 5924] set_robust_list(0x7f476940e9a0, 24 [pid 5923] <... set_robust_list resumed>) = 0 [pid 5921] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5920] <... clone3 resumed> => {parent_tid=[5925]}, 88) = 5925 [pid 5915] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5913] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 5926 attached [pid 5925] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5924] <... set_robust_list resumed>) = 0 [pid 5923] rt_sigprocmask(SIG_SETMASK, [], [pid 5920] rt_sigprocmask(SIG_SETMASK, [], [pid 5917] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5915] <... mmap resumed>) = 0x7f47693ee000 [pid 5913] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5926] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5925] <... rseq resumed>) = 0 [pid 5924] rt_sigprocmask(SIG_SETMASK, [], [pid 5923] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5921] <... clone3 resumed> => {parent_tid=[5926]}, 88) = 5926 [pid 5920] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5915] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5913] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5926] <... rseq resumed>) = 0 [pid 5924] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5917] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5913] <... futex resumed>) = 0 [pid 5926] set_robust_list(0x7f476942f9a0, 24 [pid 5925] set_robust_list(0x7f476942f9a0, 24 [pid 5924] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5923] memfd_create("syzkaller", 0 [pid 5921] rt_sigprocmask(SIG_SETMASK, [], [pid 5920] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5915] <... mprotect resumed>) = -1 (errno 18446744073709551414) [pid 5913] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5926] <... set_robust_list resumed>) = 0 [pid 5925] <... set_robust_list resumed>) = 0 [pid 5924] <... ioctl resumed>) = 0 [pid 5923] <... memfd_create resumed>) = 3 [pid 5920] <... futex resumed>) = 0 [pid 5921] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5926] rt_sigprocmask(SIG_SETMASK, [], [pid 5925] rt_sigprocmask(SIG_SETMASK, [], [pid 5924] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5923] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5921] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5920] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5917] +++ killed by SIGSEGV +++ [pid 5915] +++ killed by SIGSEGV +++ [pid 5926] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5925] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5924] <... futex resumed>) = 1 [pid 5923] <... mmap resumed>) = 0x7f4761000000 [pid 5921] <... futex resumed>) = 0 [pid 5913] <... futex resumed>) = 0 [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5915, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5926] memfd_create("syzkaller", 0 [pid 5925] memfd_create("syzkaller", 0 [pid 5924] futex(0x7f47695046d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5921] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5914] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5925] <... memfd_create resumed>) = 3 [pid 5923] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5914] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 101.011339][ T5917] exFAT-fs (loop2): Filesystem has been set read-only [ 101.016833][ T5914] exFAT-fs (loop1): Filesystem has been set read-only [pid 5926] <... memfd_create resumed>) = 3 [pid 5925] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5923] <... write resumed>) = 131072 [pid 5831] umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5924] <... futex resumed>) = ? [pid 5925] <... mmap resumed>) = 0x7f4761000000 [pid 5923] munmap(0x7f4761000000, 138412032 [pid 5914] +++ killed by SIGSEGV +++ [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5926] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5925] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5924] +++ killed by SIGSEGV +++ [pid 5923] <... munmap resumed>) = 0 [pid 5913] +++ killed by SIGSEGV +++ [pid 5831] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5926] <... mmap resumed>) = 0x7f4761000000 [pid 5925] <... write resumed>) = 131072 [pid 5831] <... openat resumed>) = 3 [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5913, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5926] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5923] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5831] newfstatat(3, "", [pid 5926] <... write resumed>) = 131072 [pid 5925] munmap(0x7f4761000000, 138412032 [pid 5923] <... openat resumed>) = 4 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] getdents64(3, [pid 5830] umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5925] <... munmap resumed>) = 0 [pid 5923] ioctl(4, LOOP_SET_FD, 3 [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5830] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] getdents64(3, [pid 5926] munmap(0x7f4761000000, 138412032 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5926] <... munmap resumed>) = 0 [pid 5830] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5926] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 5925] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5831] <... umount2 resumed>) = 0 [pid 5830] <... umount2 resumed>) = 0 [pid 5926] ioctl(4, LOOP_SET_FD, 3 [pid 5925] <... openat resumed>) = 4 [pid 5831] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5926] <... ioctl resumed>) = 0 [pid 5925] ioctl(4, LOOP_SET_FD, 3 [pid 5923] <... ioctl resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] newfstatat(AT_FDCWD, "./7/file1", [pid 5830] newfstatat(AT_FDCWD, "./6/file1", [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... openat resumed>) = 4 [pid 5830] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5923] close(3 [pid 5831] newfstatat(4, "", [pid 5830] <... openat resumed>) = 4 [pid 5923] <... close resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] newfstatat(4, "", [pid 5831] getdents64(4, [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] getdents64(4, [pid 5831] getdents64(4, [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5923] close(4 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] getdents64(4, [pid 5923] <... close resumed>) = 0 [pid 5831] close(4 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5923] mkdir("./file1", 0777 [pid 5831] <... close resumed>) = 0 [pid 5831] rmdir("./7/file1" [pid 5830] close(4 [pid 5923] <... mkdir resumed>) = 0 [pid 5831] <... rmdir resumed>) = 0 [pid 5830] <... close resumed>) = 0 [pid 5926] close(3 [pid 5925] <... ioctl resumed>) = 0 [pid 5923] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5926] <... close resumed>) = 0 [pid 5925] close(3 [pid 5831] umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] rmdir("./6/file1" [pid 5926] close(4 [pid 5925] <... close resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... rmdir resumed>) = 0 [pid 5926] <... close resumed>) = 0 [pid 5925] close(4 [pid 5831] newfstatat(AT_FDCWD, "./7/binderfs", [pid 5830] umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5926] mkdir("./file1", 0777 [pid 5925] <... close resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 101.113500][ T5923] loop3: detected capacity change from 0 to 256 [ 101.134771][ T5926] loop4: detected capacity change from 0 to 256 [ 101.147690][ T5925] loop0: detected capacity change from 0 to 256 [pid 5926] <... mkdir resumed>) = 0 [pid 5831] unlink("./7/binderfs" [pid 5830] newfstatat(AT_FDCWD, "./6/binderfs", [pid 5925] mkdir("./file1", 0777 [pid 5831] <... unlink resumed>) = 0 [pid 5925] <... mkdir resumed>) = 0 [pid 5831] getdents64(3, [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5830] unlink("./6/binderfs" [pid 5926] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5925] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5831] close(3) = 0 [pid 5831] rmdir("./7") = 0 [pid 5831] mkdir("./8", 0777) = 0 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5830] <... unlink resumed>) = 0 [pid 5830] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5830] close(3) = 0 [pid 5830] rmdir("./6") = 0 [pid 5830] mkdir("./7", 0777) = 0 [pid 5831] <... openat resumed>) = 3 [pid 5831] ioctl(3, LOOP_CLR_FD) = 0 [ 101.205533][ T5923] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5831] close(3) = 0 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5830] ioctl(3, LOOP_CLR_FD) = 0 [pid 5830] close(3 [pid 5923] <... mount resumed>) = 0 [pid 5830] <... close resumed>) = 0 ./strace-static-x86_64: Process 5927 attached [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5927] set_robust_list(0x5555612166a0, 24 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5927 [pid 5927] <... set_robust_list resumed>) = 0 [pid 5927] chdir("./8") = 0 [pid 5927] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5927] setpgid(0, 0 [pid 5923] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5923] chdir("./file1") = 0 [pid 5923] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5923] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5922] <... futex resumed>) = 0 [pid 5923] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5922] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5927] <... setpgid resumed>) = 0 [pid 5923] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5922] <... futex resumed>) = 0 [pid 5923] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5922] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5927] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5923] <... openat resumed>) = 4 [pid 5923] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5922] <... futex resumed>) = 0 [pid 5923] mkdir("./file2", 0777 [pid 5922] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5927] <... openat resumed>) = 3 [ 101.298895][ T5925] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 101.322960][ T5926] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 101.331832][ T5923] exFAT-fs (loop3): error, data size is invalid(9000) [pid 5922] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5927] write(3, "1000", 4./strace-static-x86_64: Process 5928 attached ) = 4 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5928 [pid 5927] close(3 [pid 5928] set_robust_list(0x5555612166a0, 24 [pid 5927] <... close resumed>) = 0 [pid 5927] symlink("/dev/binderfs", "./binderfs"executing program [pid 5928] <... set_robust_list resumed>) = 0 [pid 5927] <... symlink resumed>) = 0 [pid 5926] <... mount resumed>) = 0 [pid 5925] <... mount resumed>) = 0 [pid 5923] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5927] write(1, "executing program\n", 18 [pid 5928] chdir("./7" [pid 5927] <... write resumed>) = 18 [pid 5925] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5927] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5928] <... chdir resumed>) = 0 [pid 5927] <... futex resumed>) = 0 [pid 5925] <... openat resumed>) = 3 [pid 5928] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5927] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5925] chdir("./file1" [pid 5927] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5926] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5925] <... chdir resumed>) = 0 [pid 5923] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5927] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5925] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5928] <... prctl resumed>) = 0 [pid 5927] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5928] setpgid(0, 0 [pid 5927] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5926] <... openat resumed>) = 3 [pid 5925] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5922] <... futex resumed>) = ? [pid 5928] <... setpgid resumed>) = 0 [pid 5927] <... mmap resumed>) = 0x7f476940f000 [pid 5926] chdir("./file1" [pid 5925] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5923] +++ killed by SIGSEGV +++ [pid 5922] +++ killed by SIGSEGV +++ [pid 5928] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5927] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5926] <... chdir resumed>) = 0 [pid 5925] <... futex resumed>) = 1 [pid 5920] <... futex resumed>) = 0 [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5922, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5928] <... openat resumed>) = 3 [pid 5927] <... mprotect resumed>) = 0 [pid 5926] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5920] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] restart_syscall(<... resuming interrupted clone ...> [pid 5926] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5928] write(3, "1000", 4 [pid 5927] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5926] <... futex resumed>) = 1 [pid 5925] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5921] <... futex resumed>) = 0 [pid 5920] <... futex resumed>) = 0 [pid 5832] <... restart_syscall resumed>) = 0 [pid 5926] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5921] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5920] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5927] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5926] <... openat resumed>) = 4 [pid 5925] <... openat resumed>) = 4 [pid 5921] <... futex resumed>) = 0 [pid 5927] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5926] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5928] <... write resumed>) = 4 [pid 5925] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5921] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5929 attached [pid 5928] close(3 [pid 5926] <... futex resumed>) = 0 [pid 5925] <... futex resumed>) = 1 [pid 5921] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5920] <... futex resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5929] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5927] <... clone3 resumed> => {parent_tid=[5929]}, 88) = 5929 [pid 5926] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5925] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5921] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5920] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5929] <... rseq resumed>) = 0 [pid 5927] rt_sigprocmask(SIG_SETMASK, [], [pid 5926] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5925] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5921] <... futex resumed>) = 0 [pid 5920] <... futex resumed>) = 0 [ 101.349292][ T5923] exFAT-fs (loop3): Filesystem has been set read-only [pid 5832] <... openat resumed>) = 3 [pid 5929] set_robust_list(0x7f476942f9a0, 24 [pid 5928] <... close resumed>) = 0 [pid 5927] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5926] mkdir("./file2", 0777 [pid 5925] mkdir("./file2", 0777 [pid 5921] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5920] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] newfstatat(3, "", [pid 5929] <... set_robust_list resumed>) = 0 [pid 5928] symlink("/dev/binderfs", "./binderfs" [pid 5927] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 5832] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOWexecuting program [pid 5929] rt_sigprocmask(SIG_SETMASK, [], [pid 5927] <... futex resumed>) = 0 [pid 5928] <... symlink resumed>) = 0 [pid 5927] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5929] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5928] write(1, "executing program\n", 18 [pid 5929] memfd_create("syzkaller", 0 [pid 5928] <... write resumed>) = 18 [pid 5832] <... umount2 resumed>) = 0 [pid 5928] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5929] <... memfd_create resumed>) = 3 [pid 5928] <... futex resumed>) = 0 [pid 5832] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5929] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5928] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5928] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5832] newfstatat(AT_FDCWD, "./7/file1", [pid 5929] <... mmap resumed>) = 0x7f4761000000 [pid 5928] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5929] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5928] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5832] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5928] <... mmap resumed>) = 0x7f476940f000 [pid 5928] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5928] <... mprotect resumed>) = 0 [pid 5832] <... openat resumed>) = 4 [pid 5832] newfstatat(4, "", [pid 5928] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5928] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5832] getdents64(4, ./strace-static-x86_64: Process 5930 attached [pid 5930] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5928] <... clone3 resumed> => {parent_tid=[5930]}, 88) = 5930 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5930] <... rseq resumed>) = 0 [pid 5928] rt_sigprocmask(SIG_SETMASK, [], [pid 5930] set_robust_list(0x7f476942f9a0, 24 [pid 5928] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] getdents64(4, [pid 5930] <... set_robust_list resumed>) = 0 [pid 5930] rt_sigprocmask(SIG_SETMASK, [], [pid 5928] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5930] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5928] <... futex resumed>) = 0 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5930] memfd_create("syzkaller", 0 [pid 5929] <... write resumed>) = 131072 [pid 5928] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5832] close(4) = 0 [ 101.409134][ T5926] exFAT-fs (loop4): error, data size is invalid(9000) [ 101.418423][ T5925] exFAT-fs (loop0): error, data size is invalid(9000) [ 101.446610][ T5925] exFAT-fs (loop0): Filesystem has been set read-only [pid 5832] rmdir("./7/file1") = 0 [pid 5832] umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] unlink("./7/binderfs" [pid 5930] <... memfd_create resumed>) = 3 [pid 5929] munmap(0x7f4761000000, 138412032 [pid 5925] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5832] <... unlink resumed>) = 0 [pid 5930] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5929] <... munmap resumed>) = 0 [pid 5925] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5921] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5920] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5832] getdents64(3, [pid 5929] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5921] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] close(3) = 0 [pid 5832] rmdir("./7" [pid 5925] +++ killed by SIGSEGV +++ [pid 5921] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5920] +++ killed by SIGSEGV +++ [pid 5929] <... openat resumed>) = 4 [pid 5921] <... mmap resumed>) = 0x7f47693ee000 [pid 5832] <... rmdir resumed>) = 0 [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5920, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5930] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5929] ioctl(4, LOOP_SET_FD, 3 [pid 5921] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [ 101.450795][ T5926] exFAT-fs (loop4): Filesystem has been set read-only [pid 5829] restart_syscall(<... resuming interrupted clone ...> [pid 5921] <... mprotect resumed>) = 0 [pid 5832] mkdir("./8", 0777) = 0 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 5832] ioctl(3, LOOP_CLR_FD) = 0 [pid 5832] close(3) = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] <... restart_syscall resumed>) = 0 [pid 5921] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5931 ./strace-static-x86_64: Process 5931 attached [pid 5921] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5829] umount2("./6", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5932 attached ) = -1 EINVAL (Invalid argument) [pid 5932] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5921] <... clone3 resumed> => {parent_tid=[5932]}, 88) = 5932 [pid 5829] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5932] <... rseq resumed>) = 0 [pid 5921] rt_sigprocmask(SIG_SETMASK, [], [pid 5829] <... openat resumed>) = 3 [pid 5932] set_robust_list(0x7f476940e9a0, 24 [pid 5921] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5829] newfstatat(3, "", [pid 5932] <... set_robust_list resumed>) = 0 [pid 5930] <... write resumed>) = 131072 [pid 5921] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5932] rt_sigprocmask(SIG_SETMASK, [], [pid 5930] munmap(0x7f4761000000, 138412032 [pid 5921] <... futex resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5932] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5932] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5931] set_robust_list(0x5555612166a0, 24 [pid 5930] <... munmap resumed>) = 0 [pid 5921] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5829] getdents64(3, [pid 5932] <... ioctl resumed>) = 0 [pid 5931] <... set_robust_list resumed>) = 0 [pid 5930] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5929] <... ioctl resumed>) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5932] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5931] chdir("./8" [pid 5930] <... openat resumed>) = 4 [pid 5929] close(3 [pid 5829] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5932] <... futex resumed>) = 1 [pid 5931] <... chdir resumed>) = 0 [pid 5930] ioctl(4, LOOP_SET_FD, 3 [pid 5929] <... close resumed>) = 0 [pid 5921] <... futex resumed>) = 0 [pid 5929] close(4 [pid 5926] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5926] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5929] <... close resumed>) = 0 [pid 5931] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5929] mkdir("./file1", 0777 [pid 5931] <... prctl resumed>) = 0 [pid 5926] +++ killed by SIGSEGV +++ [pid 5929] <... mkdir resumed>) = 0 [pid 5829] <... umount2 resumed>) = 0 [pid 5932] +++ killed by SIGSEGV +++ [pid 5921] +++ killed by SIGSEGV +++ [pid 5931] setpgid(0, 0 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5921, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5829] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5931] <... setpgid resumed>) = 0 [pid 5929] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5833] restart_syscall(<... resuming interrupted clone ...> [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5931] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5829] newfstatat(AT_FDCWD, "./6/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5931] <... openat resumed>) = 3 [pid 5833] <... restart_syscall resumed>) = 0 [pid 5829] umount2("./6/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5931] write(3, "1000", 4) = 4 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5931] close(3 [pid 5833] umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5833] newfstatat(3, "", [pid 5931] <... close resumed>) = 0 [pid 5930] <... ioctl resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5931] symlink("/dev/binderfs", "./binderfs" [pid 5930] close(3 [ 101.479703][ T5929] loop2: detected capacity change from 0 to 256 [ 101.507474][ T5930] loop1: detected capacity change from 0 to 256 [pid 5833] getdents64(3, [pid 5931] <... symlink resumed>) = 0 [pid 5930] <... close resumed>) = 0 [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5829] <... openat resumed>) = 4 [pid 5931] write(1, "executing program\n", 18 [pid 5930] close(4 [pid 5829] newfstatat(4, "", [pid 5930] <... close resumed>) = 0 [pid 5833] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOWexecuting program [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] <... umount2 resumed>) = 0 [pid 5931] <... write resumed>) = 18 [pid 5930] mkdir("./file1", 0777 [pid 5829] getdents64(4, [pid 5931] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5930] <... mkdir resumed>) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5931] <... futex resumed>) = 0 [pid 5931] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5833] newfstatat(AT_FDCWD, "./7/file1", [pid 5829] getdents64(4, [pid 5931] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5931] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5930] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 5829] close(4 [pid 5931] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] <... close resumed>) = 0 [pid 5833] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5833] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5833] getdents64(4, [pid 5829] rmdir("./6/file1" [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5833] close(4) = 0 [pid 5833] rmdir("./7/file1" [pid 5931] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5829] <... rmdir resumed>) = 0 [pid 5931] <... mmap resumed>) = 0x7f476940f000 [pid 5829] umount2("./6/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] unlink("./7/binderfs") = 0 [pid 5833] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] close(3 [pid 5829] newfstatat(AT_FDCWD, "./6/binderfs", [pid 5833] <... close resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] rmdir("./7" [pid 5829] unlink("./6/binderfs" [pid 5931] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5829] <... unlink resumed>) = 0 [pid 5931] <... mprotect resumed>) = 0 [ 101.589367][ T5929] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5829] getdents64(3, [pid 5833] <... rmdir resumed>) = 0 [pid 5833] mkdir("./8", 0777) = 0 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5931] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5833] <... openat resumed>) = 3 [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5931] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5829] close(3 [pid 5931] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5833] ioctl(3, LOOP_CLR_FD) = 0 [pid 5833] close(3./strace-static-x86_64: Process 5933 attached [pid 5930] <... mount resumed>) = 0 [pid 5929] <... mount resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 5933] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5931] <... clone3 resumed> => {parent_tid=[5933]}, 88) = 5933 [pid 5930] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5929] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5829] rmdir("./6" [pid 5933] <... rseq resumed>) = 0 [pid 5931] rt_sigprocmask(SIG_SETMASK, [], [pid 5933] set_robust_list(0x7f476942f9a0, 24 [pid 5931] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5930] <... openat resumed>) = 3 [pid 5929] <... openat resumed>) = 3 [pid 5829] <... rmdir resumed>) = 0 [pid 5933] <... set_robust_list resumed>) = 0 [pid 5931] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5930] chdir("./file1" [pid 5929] chdir("./file1" [pid 5829] mkdir("./7", 0777 [pid 5933] rt_sigprocmask(SIG_SETMASK, [], [pid 5931] <... futex resumed>) = 0 [pid 5930] <... chdir resumed>) = 0 [pid 5929] <... chdir resumed>) = 0 [pid 5933] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5931] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5930] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5929] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] <... mkdir resumed>) = 0 ./strace-static-x86_64: Process 5934 attached [pid 5933] memfd_create("syzkaller", 0 [pid 5930] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5929] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5930] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5929] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5933] <... memfd_create resumed>) = 3 [pid 5934] set_robust_list(0x5555612166a0, 24 [pid 5933] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5930] <... futex resumed>) = 1 [ 101.629512][ T5930] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5929] <... futex resumed>) = 1 [pid 5928] <... futex resumed>) = 0 [pid 5927] <... futex resumed>) = 0 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5934 [pid 5829] <... openat resumed>) = 3 [pid 5934] <... set_robust_list resumed>) = 0 [pid 5933] <... mmap resumed>) = 0x7f4761000000 [pid 5930] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5929] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5928] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5927] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5934] chdir("./8" [pid 5930] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5929] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5829] ioctl(3, LOOP_CLR_FD [pid 5930] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5929] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5928] <... futex resumed>) = 0 [pid 5927] <... futex resumed>) = 0 [pid 5829] <... ioctl resumed>) = 0 [pid 5829] close(3 [pid 5928] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5927] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5929] <... openat resumed>) = 4 [pid 5934] <... chdir resumed>) = 0 [pid 5929] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... close resumed>) = 0 [pid 5929] <... futex resumed>) = 1 [pid 5927] <... futex resumed>) = 0 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5929] mkdir("./file2", 0777 [pid 5927] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5927] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5930] <... openat resumed>) = 4 [pid 5933] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5934] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5930] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5935 [pid 5930] <... futex resumed>) = 1 [pid 5928] <... futex resumed>) = 0 [pid 5928] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5930] mkdir("./file2", 0777 [pid 5934] <... prctl resumed>) = 0 [pid 5928] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5935 attached [pid 5935] set_robust_list(0x5555612166a0, 24 [pid 5934] setpgid(0, 0 [pid 5928] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5935] <... set_robust_list resumed>) = 0 [pid 5933] <... write resumed>) = 131072 [pid 5934] <... setpgid resumed>) = 0 [pid 5935] chdir("./7") = 0 [pid 5934] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5933] munmap(0x7f4761000000, 138412032 [pid 5930] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5935] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5934] <... openat resumed>) = 3 [pid 5935] <... prctl resumed>) = 0 [pid 5935] setpgid(0, 0 [pid 5934] write(3, "1000", 4 [pid 5933] <... munmap resumed>) = 0 [pid 5930] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5934] <... write resumed>) = 4 [pid 5933] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5934] close(3 [pid 5935] <... setpgid resumed>) = 0 [pid 5934] <... close resumed>) = 0 [pid 5933] <... openat resumed>) = 4 [pid 5928] <... futex resumed>) = ? [pid 5934] symlink("/dev/binderfs", "./binderfs" [pid 5933] ioctl(4, LOOP_SET_FD, 3 [pid 5935] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5934] <... symlink resumed>) = 0 [pid 5935] <... openat resumed>) = 3 [pid 5935] write(3, "1000", 4) = 4 executing program executing program [pid 5935] close(3) = 0 [pid 5935] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5934] write(1, "executing program\n", 18 [pid 5935] write(1, "executing program\n", 18 [pid 5934] <... write resumed>) = 18 [pid 5935] <... write resumed>) = 18 [pid 5935] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5934] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5935] <... futex resumed>) = 0 [pid 5935] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5934] <... futex resumed>) = 0 [pid 5935] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5934] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5935] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [ 101.714564][ T5929] exFAT-fs (loop2): error, data size is invalid(9000) [ 101.723544][ T5930] exFAT-fs (loop1): error, data size is invalid(9000) [ 101.732246][ T5930] exFAT-fs (loop1): Filesystem has been set read-only [ 101.745835][ T5929] exFAT-fs (loop2): Filesystem has been set read-only [pid 5935] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5934] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5930] +++ killed by SIGSEGV +++ [pid 5928] +++ killed by SIGSEGV +++ [pid 5927] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5935] <... mmap resumed>) = 0x7f476940f000 [pid 5927] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=0} [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5928, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5935] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5927] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5830] restart_syscall(<... resuming interrupted clone ...> [pid 5935] <... mprotect resumed>) = 0 [pid 5927] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5935] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5927] <... futex resumed>) = 0 [pid 5935] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5927] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5935] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5927] <... mmap resumed>) = 0x7f47693ee000 ./strace-static-x86_64: Process 5936 attached [pid 5934] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5929] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5927] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5830] <... restart_syscall resumed>) = 0 [pid 5936] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5935] <... clone3 resumed> => {parent_tid=[5936]}, 88) = 5936 [pid 5934] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5933] <... ioctl resumed>) = 0 [pid 5927] <... mprotect resumed>) = 0 [pid 5936] <... rseq resumed>) = 0 [pid 5935] rt_sigprocmask(SIG_SETMASK, [], [pid 5934] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5933] close(3 [pid 5929] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5927] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5934] <... mmap resumed>) = 0x7f476940f000 [pid 5933] <... close resumed>) = 0 [pid 5934] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5933] close(4 [pid 5934] <... mprotect resumed>) = 0 [pid 5830] umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5934] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5933] <... close resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5936] set_robust_list(0x7f476942f9a0, 24 [pid 5935] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5934] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5830] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5936] <... set_robust_list resumed>) = 0 [pid 5935] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5934] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5933] mkdir("./file1", 0777 [pid 5927] <... rt_sigprocmask resumed> ) = ? [pid 5830] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5937 attached [pid 5936] rt_sigprocmask(SIG_SETMASK, [], [pid 5935] <... futex resumed>) = 0 [pid 5933] <... mkdir resumed>) = 0 [pid 5929] +++ killed by SIGSEGV +++ [pid 5830] newfstatat(3, "", [pid 5937] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5935] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5934] <... clone3 resumed> => {parent_tid=[5937]}, 88) = 5937 [pid 5933] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5937] <... rseq resumed>) = 0 [pid 5936] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5934] rt_sigprocmask(SIG_SETMASK, [], [pid 5937] set_robust_list(0x7f476942f9a0, 24 [pid 5936] memfd_create("syzkaller", 0 [pid 5934] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5830] getdents64(3, [pid 5937] <... set_robust_list resumed>) = 0 [pid 5936] <... memfd_create resumed>) = 3 [pid 5934] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5937] rt_sigprocmask(SIG_SETMASK, [], [pid 5936] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5934] <... futex resumed>) = 0 [pid 5927] +++ killed by SIGSEGV +++ [pid 5830] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5937] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5936] <... mmap resumed>) = 0x7f4761000000 [pid 5934] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5937] memfd_create("syzkaller", 0 [pid 5936] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5830] <... umount2 resumed>) = 0 [pid 5937] <... memfd_create resumed>) = 3 [ 101.772112][ T5933] loop3: detected capacity change from 0 to 256 [pid 5937] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5830] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5937] <... mmap resumed>) = 0x7f4761000000 [pid 5936] <... write resumed>) = 131072 [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5927, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] newfstatat(AT_FDCWD, "./7/file1", [pid 5937] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5936] munmap(0x7f4761000000, 138412032 [pid 5831] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5936] <... munmap resumed>) = 0 [pid 5831] <... openat resumed>) = 3 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5936] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5831] newfstatat(3, "", [pid 5830] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5936] <... openat resumed>) = 4 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] <... openat resumed>) = 4 [pid 5936] ioctl(4, LOOP_SET_FD, 3 [pid 5831] getdents64(3, [pid 5830] newfstatat(4, "", [pid 5937] <... write resumed>) = 131072 [pid 5937] munmap(0x7f4761000000, 138412032 [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5937] <... munmap resumed>) = 0 [pid 5937] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 5937] ioctl(4, LOOP_SET_FD, 3 [pid 5936] <... ioctl resumed>) = 0 [pid 5830] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] close(4) = 0 [pid 5830] rmdir("./7/file1") = 0 [pid 5830] umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5830] newfstatat(AT_FDCWD, "./7/binderfs", [pid 5831] <... umount2 resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5936] close(3 [pid 5831] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] unlink("./7/binderfs" [pid 5936] <... close resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5936] close(4 [pid 5831] newfstatat(AT_FDCWD, "./8/file1", [pid 5936] <... close resumed>) = 0 [pid 5936] mkdir("./file1", 0777 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] <... unlink resumed>) = 0 [pid 5936] <... mkdir resumed>) = 0 [pid 5831] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5936] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] getdents64(3, [pid 5831] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5831] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] getdents64(4, [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] getdents64(4, [pid 5830] close(3 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] <... close resumed>) = 0 [pid 5831] close(4 [pid 5830] rmdir("./7" [pid 5831] <... close resumed>) = 0 [pid 5830] <... rmdir resumed>) = 0 [pid 5830] mkdir("./8", 0777) = 0 [ 101.845559][ T5933] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 101.855379][ T5936] loop0: detected capacity change from 0 to 256 [ 101.878534][ T5937] loop4: detected capacity change from 0 to 256 [pid 5831] rmdir("./8/file1") = 0 [pid 5933] <... mount resumed>) = 0 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5831] umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... openat resumed>) = 3 [pid 5933] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5937] <... ioctl resumed>) = 0 [pid 5933] <... openat resumed>) = 3 [pid 5831] newfstatat(AT_FDCWD, "./8/binderfs", [pid 5937] close(3 [pid 5933] chdir("./file1" [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] <... ioctl resumed>) = 0 [pid 5933] <... chdir resumed>) = 0 [pid 5831] unlink("./8/binderfs" [pid 5830] close(3 [pid 5933] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5831] <... unlink resumed>) = 0 [pid 5830] <... close resumed>) = 0 [pid 5933] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5831] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] close(3 [pid 5933] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... close resumed>) = 0 [pid 5933] <... futex resumed>) = 1 [pid 5831] rmdir("./8" [pid 5933] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5831] <... rmdir resumed>) = 0 [pid 5937] <... close resumed>) = 0 [pid 5931] <... futex resumed>) = 0 [pid 5831] mkdir("./9", 0777) = 0 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5938 attached [pid 5831] <... openat resumed>) = 3 [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5938 [pid 5831] <... ioctl resumed>) = 0 [pid 5938] set_robust_list(0x5555612166a0, 24 [pid 5831] close(3 [pid 5938] <... set_robust_list resumed>) = 0 [pid 5937] close(4 [pid 5931] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5938] chdir("./8" [pid 5937] <... close resumed>) = 0 [pid 5933] <... futex resumed>) = 0 [pid 5931] <... futex resumed>) = 1 [pid 5937] mkdir("./file1", 0777 [pid 5933] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5931] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5938] <... chdir resumed>) = 0 [pid 5938] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5937] <... mkdir resumed>) = 0 [pid 5831] <... close resumed>) = 0 [pid 5937] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5938] <... prctl resumed>) = 0 [ 101.944965][ T5936] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5938] setpgid(0, 0 [pid 5936] <... mount resumed>) = 0 [pid 5933] <... openat resumed>) = 4 [pid 5933] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5931] <... futex resumed>) = 0 [pid 5933] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5931] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5933] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5931] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5939 attached [pid 5936] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5933] mkdir("./file2", 0777 [pid 5931] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5938] <... setpgid resumed>) = 0 [pid 5936] <... openat resumed>) = 3 [pid 5936] chdir("./file1") = 0 [pid 5936] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5939] set_robust_list(0x5555612166a0, 24 [pid 5938] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5936] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5939 [ 102.031672][ T5933] exFAT-fs (loop3): error, data size is invalid(9000) [ 102.058904][ T5933] exFAT-fs (loop3): Filesystem has been set read-only [pid 5936] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5935] <... futex resumed>) = 0 [pid 5935] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5939] <... set_robust_list resumed>) = 0 [pid 5938] <... openat resumed>) = 3 [pid 5936] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5935] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5931] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5938] write(3, "1000", 4 [pid 5931] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5938] <... write resumed>) = 4 [pid 5938] close(3 [pid 5933] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5938] <... close resumed>) = 0 [pid 5938] symlink("/dev/binderfs", "./binderfs" [pid 5933] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5931] <... futex resumed>) = 0 executing program [pid 5938] <... symlink resumed>) = 0 [pid 5938] write(1, "executing program\n", 18) = 18 [pid 5938] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5933] +++ killed by SIGSEGV +++ [pid 5938] <... futex resumed>) = 0 [pid 5938] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5931] +++ killed by SIGSEGV +++ [pid 5938] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5939] chdir("./9" [pid 5938] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5936] <... openat resumed>) = 4 [pid 5938] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5936] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5938] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5936] <... futex resumed>) = 1 [pid 5935] <... futex resumed>) = 0 [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5931, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5935] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5935] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5939] <... chdir resumed>) = 0 [pid 5939] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5939] setpgid(0, 0 [pid 5937] <... mount resumed>) = 0 [pid 5832] umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5939] <... setpgid resumed>) = 0 [pid 5938] <... mmap resumed>) = 0x7f476940f000 [pid 5939] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5938] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5938] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5939] <... openat resumed>) = 3 [pid 5938] <... rt_sigprocmask resumed>[], 8) = 0 [ 102.060845][ T5937] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5938] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5936] mkdir("./file2", 0777 [pid 5939] write(3, "1000", 4 [pid 5938] <... clone3 resumed> => {parent_tid=[5940]}, 88) = 5940 [pid 5937] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5940 attached [pid 5939] <... write resumed>) = 4 [pid 5938] rt_sigprocmask(SIG_SETMASK, [], [pid 5937] <... openat resumed>) = 3 [pid 5832] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5940] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5939] close(3 [pid 5937] chdir("./file1" [pid 5940] <... rseq resumed>) = 0 [pid 5939] <... close resumed>) = 0 [pid 5938] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5937] <... chdir resumed>) = 0 [pid 5832] <... openat resumed>) = 3 [pid 5940] set_robust_list(0x7f476942f9a0, 24 [pid 5939] symlink("/dev/binderfs", "./binderfs" [pid 5938] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5937] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5832] newfstatat(3, "", [pid 5940] <... set_robust_list resumed>) = 0 [pid 5939] <... symlink resumed>) = 0 [pid 5938] <... futex resumed>) = 0 [pid 5940] rt_sigprocmask(SIG_SETMASK, [], [pid 5937] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5940] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5939] write(1, "executing program\n", 18 [pid 5938] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5937] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] getdents64(3, executing program [pid 5940] memfd_create("syzkaller", 0 [pid 5939] <... write resumed>) = 18 [pid 5937] <... futex resumed>) = 1 [pid 5934] <... futex resumed>) = 0 [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5940] <... memfd_create resumed>) = 3 [pid 5939] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5934] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5940] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5939] <... futex resumed>) = 0 [pid 5937] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5934] <... futex resumed>) = 0 [pid 5940] <... mmap resumed>) = 0x7f4761000000 [pid 5939] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5935] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5832] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5940] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5939] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5935] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [ 102.120217][ T5936] exFAT-fs (loop0): error, data size is invalid(9000) [pid 5934] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5940] <... write resumed>) = 131072 [pid 5939] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5937] <... openat resumed>) = 4 [pid 5935] <... futex resumed>) = 0 [pid 5939] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5937] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5935] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5939] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5937] <... futex resumed>) = 1 [pid 5935] <... mmap resumed>) = 0x7f47693ee000 [pid 5934] <... futex resumed>) = 0 [pid 5939] <... mmap resumed>) = 0x7f476940f000 [pid 5937] mkdir("./file2", 0777 [pid 5935] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5934] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5940] munmap(0x7f4761000000, 138412032 [pid 5939] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5940] <... munmap resumed>) = 0 [pid 5939] <... mprotect resumed>) = 0 [pid 5935] <... mprotect resumed>) = 0 [pid 5934] <... futex resumed>) = 0 [pid 5939] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5935] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5934] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5939] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5935] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5940] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5939] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5936] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5935] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5832] <... umount2 resumed>) = 0 [pid 5832] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5940] <... openat resumed>) = 4 [pid 5936] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5942 attached [pid 5832] newfstatat(AT_FDCWD, "./8/file1", [pid 5942] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053./strace-static-x86_64: Process 5941 attached ) = 0 [pid 5940] ioctl(4, LOOP_SET_FD, 3 [pid 5939] <... clone3 resumed> => {parent_tid=[5942]}, 88) = 5942 [ 102.194432][ T5937] exFAT-fs (loop4): error, data size is invalid(9000) [ 102.202577][ T5936] exFAT-fs (loop0): Filesystem has been set read-only [ 102.232569][ T5940] loop1: detected capacity change from 0 to 256 [pid 5935] <... clone3 resumed> ) = ? [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5942] set_robust_list(0x7f476942f9a0, 24 [pid 5941] +++ killed by SIGSEGV +++ [pid 5939] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5939] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5939] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5942] <... set_robust_list resumed>) = 0 [pid 5832] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5942] rt_sigprocmask(SIG_SETMASK, [], [pid 5940] <... ioctl resumed>) = 0 [pid 5937] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5936] +++ killed by SIGSEGV +++ [pid 5935] +++ killed by SIGSEGV +++ [pid 5934] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5942] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5940] close(3 [pid 5937] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5934] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5934] <... futex resumed>) = 0 [pid 5942] memfd_create("syzkaller", 0 [pid 5934] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5935, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5942] <... memfd_create resumed>) = 3 [pid 5934] <... mmap resumed>) = 0x3 [pid 5832] <... openat resumed>) = 4 [pid 5940] <... close resumed>) = 0 [pid 5829] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5942] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5940] close(4 [pid 5937] +++ killed by SIGSEGV +++ [pid 5934] +++ killed by SIGSEGV +++ [pid 5832] newfstatat(4, "", [pid 5940] <... close resumed>) = 0 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5934, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5940] mkdir("./file1", 0777 [pid 5832] getdents64(4, [pid 5833] umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5942] <... mmap resumed>) = 0x7f4761000000 [pid 5940] <... mkdir resumed>) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] umount2("./7", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5833] newfstatat(3, "", [pid 5940] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] getdents64(4, [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5832] close(4 [pid 5833] getdents64(3, [pid 5832] <... close resumed>) = 0 [pid 5829] <... openat resumed>) = 3 [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5833] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] rmdir("./8/file1" [pid 5829] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] <... rmdir resumed>) = 0 [pid 5829] getdents64(3, [ 102.240897][ T5937] exFAT-fs (loop4): Filesystem has been set read-only [pid 5832] umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5942] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5833] <... umount2 resumed>) = 0 [pid 5833] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./8/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5833] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5833] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5833] close(4) = 0 [pid 5833] rmdir("./8/file1") = 0 [pid 5833] umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5829] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] unlink("./8/binderfs") = 0 [pid 5833] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5833] close(3) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] rmdir("./8" [pid 5942] <... write resumed>) = 131072 [pid 5833] <... rmdir resumed>) = 0 [pid 5832] newfstatat(AT_FDCWD, "./8/binderfs", [pid 5829] <... umount2 resumed>) = 0 [pid 5829] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5942] munmap(0x7f4761000000, 138412032 [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] newfstatat(AT_FDCWD, "./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] umount2("./7/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] unlink("./8/binderfs" [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5942] <... munmap resumed>) = 0 [pid 5833] mkdir("./9", 0777 [pid 5829] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5942] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5940] <... mount resumed>) = 0 [pid 5833] <... mkdir resumed>) = 0 [pid 5832] <... unlink resumed>) = 0 [pid 5829] <... openat resumed>) = 4 [pid 5832] getdents64(3, [pid 5829] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5942] <... openat resumed>) = 4 [pid 5940] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5832] close(3 [pid 5829] getdents64(4, [pid 5942] ioctl(4, LOOP_SET_FD, 3 [pid 5940] <... openat resumed>) = 3 [pid 5833] <... openat resumed>) = 3 [pid 5832] <... close resumed>) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5832] rmdir("./8" [ 102.312165][ T5940] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5829] getdents64(4, [pid 5833] <... ioctl resumed>) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5833] close(3 [pid 5829] close(4 [pid 5833] <... close resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 5829] rmdir("./7/file1") = 0 [pid 5829] umount2("./7/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5829] newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] unlink("./7/binderfs") = 0 [pid 5829] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] close(3) = 0 [pid 5832] <... rmdir resumed>) = 0 [pid 5829] rmdir("./7") = 0 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] mkdir("./8", 0777) = 0 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5940] chdir("./file1" [pid 5832] mkdir("./9", 0777 [pid 5829] <... openat resumed>) = 3 [pid 5829] ioctl(3, LOOP_CLR_FD) = 0 [pid 5829] close(3) = 0 ./strace-static-x86_64: Process 5943 attached [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5944 attached [pid 5943] set_robust_list(0x5555612166a0, 24 [pid 5944] set_robust_list(0x5555612166a0, 24) = 0 [pid 5944] chdir("./8" [pid 5943] <... set_robust_list resumed>) = 0 [pid 5940] <... chdir resumed>) = 0 [pid 5832] <... mkdir resumed>) = 0 [pid 5944] <... chdir resumed>) = 0 [pid 5943] chdir("./9" [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5943 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5944 [pid 5944] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5940] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5944] <... prctl resumed>) = 0 [pid 5943] <... chdir resumed>) = 0 [pid 5940] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5832] <... openat resumed>) = 3 [pid 5944] setpgid(0, 0 [pid 5943] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5940] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5944] <... setpgid resumed>) = 0 [pid 5943] <... prctl resumed>) = 0 [pid 5943] setpgid(0, 0) = 0 [pid 5940] <... futex resumed>) = 1 [pid 5938] <... futex resumed>) = 0 [pid 5832] <... ioctl resumed>) = 0 [pid 5943] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5940] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5938] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] close(3 [pid 5944] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5943] <... openat resumed>) = 3 [pid 5942] <... ioctl resumed>) = 0 [pid 5940] <... openat resumed>) = 4 [pid 5938] <... futex resumed>) = 0 [pid 5832] <... close resumed>) = 0 [pid 5942] close(3 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5944] <... openat resumed>) = 3 [pid 5943] write(3, "1000", 4 [pid 5942] <... close resumed>) = 0 [pid 5938] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 102.357319][ T5942] loop2: detected capacity change from 0 to 256 [pid 5940] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5944] write(3, "1000", 4 [pid 5943] <... write resumed>) = 4 [pid 5942] close(4 [pid 5940] <... futex resumed>) = 1 [pid 5938] <... futex resumed>) = 0 [pid 5944] <... write resumed>) = 4 [pid 5943] close(3 [pid 5942] <... close resumed>) = 0 [pid 5940] mkdir("./file2", 0777 [pid 5938] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5945 attached [pid 5945] set_robust_list(0x5555612166a0, 24 [pid 5944] close(3 [pid 5943] <... close resumed>) = 0 [pid 5942] mkdir("./file1", 0777 [pid 5938] <... futex resumed>) = 0 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5945 [pid 5945] <... set_robust_list resumed>) = 0 [pid 5944] <... close resumed>) = 0 [pid 5942] <... mkdir resumed>) = 0 [pid 5944] symlink("/dev/binderfs", "./binderfs" [pid 5938] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5945] chdir("./9") = 0 [pid 5944] <... symlink resumed>) = 0 [pid 5943] symlink("/dev/binderfs", "./binderfs" [pid 5942] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5945] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5944] write(1, "executing program\n", 18 [pid 5943] <... symlink resumed>) = 0 executing program executing program [pid 5945] setpgid(0, 0 [pid 5944] <... write resumed>) = 18 [pid 5943] write(1, "executing program\n", 18 [pid 5945] <... setpgid resumed>) = 0 [pid 5945] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5943] <... write resumed>) = 18 [pid 5943] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5944] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5943] <... futex resumed>) = 0 [pid 5944] <... futex resumed>) = 0 [pid 5943] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5944] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5943] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5944] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5943] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5944] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5943] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5944] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5943] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5945] <... openat resumed>) = 3 [pid 5944] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5945] write(3, "1000", 4 [pid 5944] <... mmap resumed>) = 0x7f476940f000 [pid 5945] <... write resumed>) = 4 [pid 5945] close(3) = 0 [pid 5944] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5945] symlink("/dev/binderfs", "./binderfs" [pid 5944] <... mprotect resumed>) = 0 [pid 5945] <... symlink resumed>) = 0 [pid 5944] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5943] <... mmap resumed>) = 0x7f476940f000 [ 102.415168][ T5940] exFAT-fs (loop1): error, data size is invalid(9000) [pid 5944] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}executing program [pid 5943] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 5946 attached [pid 5945] write(1, "executing program\n", 18 [pid 5946] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5945] <... write resumed>) = 18 [pid 5938] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5938] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5938] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5946] <... rseq resumed>) = 0 [pid 5945] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5944] <... clone3 resumed> => {parent_tid=[5946]}, 88) = 5946 [pid 5943] <... mprotect resumed>) = 0 [pid 5946] set_robust_list(0x7f476942f9a0, 24 [pid 5945] <... futex resumed>) = 0 [pid 5946] <... set_robust_list resumed>) = 0 [pid 5945] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5944] rt_sigprocmask(SIG_SETMASK, [], [pid 5943] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5946] rt_sigprocmask(SIG_SETMASK, [], [pid 5945] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5946] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5945] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5944] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5943] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5946] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5945] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5945] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5944] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5943] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 5947 attached [pid 5946] <... futex resumed>) = 0 [pid 5945] <... mmap resumed>) = 0x7f476940f000 [pid 5944] <... futex resumed>) = 1 [ 102.460524][ T5940] exFAT-fs (loop1): Filesystem has been set read-only [pid 5947] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5946] memfd_create("syzkaller", 0 [pid 5947] <... rseq resumed>) = 0 [pid 5945] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5944] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5943] <... clone3 resumed> => {parent_tid=[5947]}, 88) = 5947 [pid 5940] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5938] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5947] set_robust_list(0x7f476942f9a0, 24 [pid 5946] <... memfd_create resumed>) = 3 [pid 5945] <... mprotect resumed>) = 0 [pid 5943] rt_sigprocmask(SIG_SETMASK, [], [pid 5940] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5938] <... mprotect resumed>) = 0 [pid 5947] <... set_robust_list resumed>) = 0 [pid 5945] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5943] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5938] read(0, [pid 5947] rt_sigprocmask(SIG_SETMASK, [], [pid 5946] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5945] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5943] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5947] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5943] <... futex resumed>) = 0 [pid 5943] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5947] memfd_create("syzkaller", 0 [pid 5946] <... mmap resumed>) = 0x7f4761000000 [pid 5945] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5940] +++ killed by SIGSEGV +++ [pid 5938] +++ killed by SIGSEGV +++ [pid 5947] <... memfd_create resumed>) = 3 ./strace-static-x86_64: Process 5948 attached [ 102.499332][ T5942] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5947] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5946] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5942] <... mount resumed>) = 0 [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5938, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5948] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053) = 0 [pid 5948] set_robust_list(0x7f476942f9a0, 24) = 0 [pid 5948] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5948] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5942] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5942] chdir("./file1") = 0 [pid 5942] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5942] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5939] <... futex resumed>) = 0 [pid 5942] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5939] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5942] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5939] <... futex resumed>) = 0 [pid 5939] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5942] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 5942] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5947] <... mmap resumed>) = 0x7f4761000000 [pid 5946] <... write resumed>) = 131072 [pid 5945] <... clone3 resumed> => {parent_tid=[5948]}, 88) = 5948 [pid 5946] munmap(0x7f4761000000, 138412032 [pid 5942] <... futex resumed>) = 1 [pid 5939] <... futex resumed>) = 0 [pid 5830] umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5945] rt_sigprocmask(SIG_SETMASK, [], [pid 5939] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5939] <... futex resumed>) = 0 [pid 5945] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5939] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5945] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5942] mkdir("./file2", 0777 [pid 5830] <... openat resumed>) = 3 [pid 5948] <... futex resumed>) = 0 [pid 5946] <... munmap resumed>) = 0 [pid 5945] <... futex resumed>) = 1 [pid 5830] newfstatat(3, "", [pid 5948] memfd_create("syzkaller", 0 [pid 5947] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5946] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5945] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5948] <... memfd_create resumed>) = 3 [pid 5948] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5830] getdents64(3, [pid 5948] <... mmap resumed>) = 0x7f4761000000 [pid 5946] <... openat resumed>) = 4 [pid 5948] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5947] <... write resumed>) = 131072 [pid 5946] ioctl(4, LOOP_SET_FD, 3 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5948] <... write resumed>) = 131072 [pid 5948] munmap(0x7f4761000000, 138412032 [pid 5830] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5947] munmap(0x7f4761000000, 138412032) = 0 [pid 5939] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5939] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5948] <... munmap resumed>) = 0 [pid 5939] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5830] <... umount2 resumed>) = 0 [pid 5948] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5947] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5939] <... mmap resumed>) = 0x7f47693ee000 [pid 5830] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5948] <... openat resumed>) = 4 [pid 5939] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [ 102.595462][ T5942] exFAT-fs (loop2): error, data size is invalid(9000) [ 102.616381][ T5946] loop0: detected capacity change from 0 to 256 [ 102.631715][ T5942] exFAT-fs (loop2): Filesystem has been set read-only [pid 5939] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5948] ioctl(4, LOOP_SET_FD, 3 [pid 5939] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5947] <... openat resumed>) = 4 [pid 5946] <... ioctl resumed>) = 0 [pid 5939] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5947] ioctl(4, LOOP_SET_FD, 3 [pid 5946] close(3 [pid 5830] newfstatat(AT_FDCWD, "./8/file1", [pid 5939] <... clone3 resumed> => {parent_tid=[5949]}, 88) = 5949 [pid 5939] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5939] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5949 attached [pid 5942] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5939] <... futex resumed>) = 0 [pid 5949] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5942] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5939] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5949] <... rseq resumed>) = ? [pid 5939] <... futex resumed>) = ? [pid 5942] +++ killed by SIGSEGV +++ [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5946] <... close resumed>) = 0 [pid 5830] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5946] close(4 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5948] <... ioctl resumed>) = 0 [pid 5830] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5949] +++ killed by SIGSEGV +++ [pid 5946] <... close resumed>) = 0 [pid 5939] +++ killed by SIGSEGV +++ [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5939, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5830] <... openat resumed>) = 4 [pid 5946] mkdir("./file1", 0777 [pid 5948] close(3 [pid 5831] umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] newfstatat(4, "", [pid 5948] <... close resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5948] close(4 [pid 5946] <... mkdir resumed>) = 0 [pid 5831] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5947] <... ioctl resumed>) = 0 [pid 5946] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5831] <... openat resumed>) = 3 [pid 5948] <... close resumed>) = 0 [pid 5831] newfstatat(3, "", [pid 5830] getdents64(4, [pid 5948] mkdir("./file1", 0777 [pid 5947] close(3 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5948] <... mkdir resumed>) = 0 [pid 5831] getdents64(3, [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5947] <... close resumed>) = 0 [pid 5830] getdents64(4, [pid 5947] close(4 [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5947] <... close resumed>) = 0 [pid 5831] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] close(4 [pid 5947] mkdir("./file1", 0777 [pid 5830] <... close resumed>) = 0 [pid 5948] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5947] <... mkdir resumed>) = 0 [pid 5831] <... umount2 resumed>) = 0 [ 102.657540][ T5948] loop3: detected capacity change from 0 to 256 [ 102.674290][ T5947] loop4: detected capacity change from 0 to 256 [pid 5830] rmdir("./8/file1" [pid 5831] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... rmdir resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] newfstatat(AT_FDCWD, "./9/file1", [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5947] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] newfstatat(AT_FDCWD, "./8/binderfs", [pid 5831] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] unlink("./8/binderfs" [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... unlink resumed>) = 0 [pid 5830] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5830] close(3) = 0 [pid 5831] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [ 102.760574][ T5946] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 102.781210][ T5947] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5830] rmdir("./8" [pid 5831] <... openat resumed>) = 4 [pid 5831] newfstatat(4, "", [pid 5830] <... rmdir resumed>) = 0 [pid 5830] mkdir("./9", 0777 [pid 5946] <... mount resumed>) = 0 [pid 5830] <... mkdir resumed>) = 0 [pid 5946] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5946] <... openat resumed>) = 3 [pid 5830] <... openat resumed>) = 3 [pid 5946] chdir("./file1" [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5946] <... chdir resumed>) = 0 [pid 5830] <... ioctl resumed>) = 0 [pid 5946] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5830] close(3 [pid 5946] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5831] getdents64(4, [pid 5946] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5946] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5947] <... mount resumed>) = 0 [pid 5944] <... futex resumed>) = 0 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5947] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5944] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] getdents64(4, [pid 5947] <... openat resumed>) = 3 [ 102.802257][ T5948] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5946] <... futex resumed>) = 0 [pid 5944] <... futex resumed>) = 1 [pid 5947] chdir("./file1" [pid 5946] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5944] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] <... close resumed>) = 0 [pid 5947] <... chdir resumed>) = 0 [pid 5946] <... openat resumed>) = 4 [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5948] <... mount resumed>) = 0 [pid 5947] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5946] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] close(4 [pid 5948] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5947] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5946] <... futex resumed>) = 1 [pid 5831] <... close resumed>) = 0 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5950 ./strace-static-x86_64: Process 5950 attached [pid 5948] <... openat resumed>) = 3 [pid 5947] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5946] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5944] <... futex resumed>) = 0 [pid 5831] rmdir("./9/file1" [pid 5948] chdir("./file1" [pid 5947] <... futex resumed>) = 1 [pid 5944] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5943] <... futex resumed>) = 0 [pid 5948] <... chdir resumed>) = 0 [pid 5947] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5943] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... rmdir resumed>) = 0 [pid 5948] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5947] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5946] <... futex resumed>) = 0 [pid 5944] <... futex resumed>) = 1 [pid 5943] <... futex resumed>) = 0 [pid 5831] umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5950] set_robust_list(0x5555612166a0, 24 [pid 5948] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5947] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5946] mkdir("./file2", 0777 [pid 5944] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5943] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5950] <... set_robust_list resumed>) = 0 [pid 5948] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5947] <... openat resumed>) = 4 [pid 5948] <... futex resumed>) = 1 [pid 5945] <... futex resumed>) = 0 [pid 5945] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5948] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5945] <... futex resumed>) = 0 [pid 5945] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5948] <... openat resumed>) = 4 [pid 5947] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5947] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5831] newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5950] chdir("./9" [pid 5948] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5943] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5831] unlink("./9/binderfs" [pid 5948] <... futex resumed>) = 1 [pid 5945] <... futex resumed>) = 0 [pid 5948] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5945] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5948] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5943] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... unlink resumed>) = 0 [pid 5948] mkdir("./file2", 0777 [pid 5947] <... futex resumed>) = 0 [pid 5945] <... futex resumed>) = 0 [pid 5943] <... futex resumed>) = 1 [pid 5950] <... chdir resumed>) = 0 [pid 5831] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] close(3) = 0 [pid 5831] rmdir("./9" [pid 5950] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5947] mkdir("./file2", 0777 [pid 5950] <... prctl resumed>) = 0 [pid 5945] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5943] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... rmdir resumed>) = 0 [pid 5950] setpgid(0, 0 [pid 5831] mkdir("./10", 0777) = 0 [pid 5950] <... setpgid resumed>) = 0 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 5950] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [ 102.905529][ T5946] exFAT-fs (loop0): error, data size is invalid(9000) [ 102.922463][ T5948] exFAT-fs (loop3): error, data size is invalid(9000) [ 102.947489][ T5947] exFAT-fs (loop4): error, data size is invalid(9000) [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5950] <... openat resumed>) = 3 [pid 5944] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5944] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5944] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5944] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5950] write(3, "1000", 4 [pid 5944] <... mprotect resumed>) = 0 [pid 5831] <... ioctl resumed>) = 0 [pid 5950] <... write resumed>) = 4 [pid 5944] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5950] close(3 [pid 5944] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5831] close(3 [pid 5950] <... close resumed>) = 0 [pid 5831] <... close resumed>) = 0 [pid 5950] symlink("/dev/binderfs", "./binderfs" [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5945] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) ./strace-static-x86_64: Process 5951 attached [pid 5950] <... symlink resumed>) = 0 [pid 5948] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5947] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5946] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5945] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5944] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} executing program [pid 5943] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) ./strace-static-x86_64: Process 5952 attached [pid 5951] set_robust_list(0x5555612166a0, 24 [pid 5950] write(1, "executing program\n", 18 [pid 5948] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5947] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5946] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5945] <... futex resumed>) = ? [pid 5943] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5951 [pid 5951] <... set_robust_list resumed>) = 0 [pid 5950] <... write resumed>) = 18 [ 102.961065][ T5947] exFAT-fs (loop4): Filesystem has been set read-only [ 102.975290][ T5948] exFAT-fs (loop3): Filesystem has been set read-only [ 102.978066][ T5946] exFAT-fs (loop0): Filesystem has been set read-only [pid 5943] <... futex resumed>) = ? [pid 5951] chdir("./10" [pid 5950] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5948] +++ killed by SIGSEGV +++ [pid 5947] +++ killed by SIGSEGV +++ [pid 5945] +++ killed by SIGSEGV +++ [pid 5944] <... clone3 resumed> ) = ? [pid 5943] +++ killed by SIGSEGV +++ [pid 5952] +++ killed by SIGSEGV +++ [pid 5950] <... futex resumed>) = 0 [pid 5946] +++ killed by SIGSEGV +++ [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5945, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5951] <... chdir resumed>) = 0 [pid 5950] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5944] +++ killed by SIGSEGV +++ [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5943, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5950] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5833] restart_syscall(<... resuming interrupted clone ...> [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5944, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5950] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5833] <... restart_syscall resumed>) = 0 [pid 5950] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5950] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5950] <... mmap resumed>) = 0x7f476940f000 [pid 5833] umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5950] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] umount2("./8", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] <... openat resumed>) = 3 [pid 5950] <... mprotect resumed>) = 0 [pid 5833] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5832] newfstatat(3, "", [pid 5950] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5833] <... openat resumed>) = 3 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5950] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5833] newfstatat(3, "", [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5950] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] getdents64(3, [pid 5829] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5953 attached [pid 5833] getdents64(3, [pid 5829] newfstatat(3, "", [pid 5950] <... clone3 resumed> => {parent_tid=[5953]}, 88) = 5953 [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5953] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5951] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5950] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] getdents64(3, [pid 5953] <... rseq resumed>) = 0 [pid 5951] <... prctl resumed>) = 0 [pid 5950] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5953] set_robust_list(0x7f476942f9a0, 24 [pid 5951] setpgid(0, 0 [pid 5950] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5953] <... set_robust_list resumed>) = 0 [pid 5951] <... setpgid resumed>) = 0 [pid 5950] <... futex resumed>) = 0 [pid 5953] rt_sigprocmask(SIG_SETMASK, [], [pid 5951] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5950] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5953] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5951] <... openat resumed>) = 3 [pid 5953] memfd_create("syzkaller", 0) = 3 [pid 5953] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5833] <... umount2 resumed>) = 0 [pid 5832] <... umount2 resumed>) = 0 [pid 5829] <... umount2 resumed>) = 0 [pid 5832] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./9/file1", [pid 5829] newfstatat(AT_FDCWD, "./8/file1", [pid 5833] newfstatat(AT_FDCWD, "./9/file1", [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5951] write(3, "1000", 4 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5953] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5832] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5951] <... write resumed>) = 4 [pid 5829] umount2("./8/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5951] close(3 [pid 5833] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... openat resumed>) = 4 [pid 5833] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] newfstatat(4, "", [pid 5832] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5833] <... openat resumed>) = 4 [pid 5832] <... openat resumed>) = 4 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] newfstatat(4, "", [pid 5829] getdents64(4, [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5953] <... write resumed>) = 131072 [pid 5951] <... close resumed>) = 0 [pid 5833] newfstatat(4, "", [pid 5832] getdents64(4, [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5951] symlink("/dev/binderfs", "./binderfs" [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 executing program [pid 5951] <... symlink resumed>) = 0 [pid 5833] getdents64(4, [pid 5829] getdents64(4, [pid 5951] write(1, "executing program\n", 18 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5953] munmap(0x7f4761000000, 138412032 [pid 5951] <... write resumed>) = 18 [pid 5833] getdents64(4, [pid 5829] close(4 [pid 5953] <... munmap resumed>) = 0 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5832] getdents64(4, [pid 5953] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5951] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] close(4 [pid 5829] <... close resumed>) = 0 [pid 5953] <... openat resumed>) = 4 [pid 5951] <... futex resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5953] ioctl(4, LOOP_SET_FD, 3 [pid 5833] rmdir("./9/file1" [pid 5951] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5832] close(4 [pid 5829] rmdir("./8/file1" [pid 5951] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5829] <... rmdir resumed>) = 0 [pid 5951] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5829] umount2("./8/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5951] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... close resumed>) = 0 [pid 5951] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] rmdir("./9/file1" [pid 5951] <... mmap resumed>) = 0x7f476940f000 [pid 5833] umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] newfstatat(AT_FDCWD, "./8/binderfs", [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5951] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5833] newfstatat(AT_FDCWD, "./9/binderfs", [pid 5832] <... rmdir resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] unlink("./8/binderfs" [pid 5951] <... mprotect resumed>) = 0 [pid 5833] unlink("./9/binderfs" [pid 5951] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5833] <... unlink resumed>) = 0 [pid 5829] <... unlink resumed>) = 0 [pid 5833] getdents64(3, [pid 5951] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5833] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] getdents64(3, [pid 5951] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5833] close(3 [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5951] <... clone3 resumed> => {parent_tid=[5954]}, 88) = 5954 [pid 5833] <... close resumed>) = 0 [pid 5829] close(3 [pid 5951] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] rmdir("./9" [pid 5829] <... close resumed>) = 0 [pid 5951] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5829] rmdir("./8" [pid 5951] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] mkdir("./10", 0777 [pid 5951] <... futex resumed>) = 0 [pid 5833] <... mkdir resumed>) = 0 [pid 5829] <... rmdir resumed>) = 0 [pid 5951] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5954 attached [pid 5954] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053) = 0 [pid 5954] set_robust_list(0x7f476942f9a0, 24) = 0 [pid 5954] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5954] memfd_create("syzkaller", 0) = 3 [pid 5954] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5954] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5832] umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5953] <... ioctl resumed>) = 0 [pid 5954] <... write resumed>) = 131072 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] mkdir("./9", 0777 [ 103.189597][ T5953] loop1: detected capacity change from 0 to 256 [pid 5832] newfstatat(AT_FDCWD, "./9/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] unlink("./9/binderfs" [pid 5829] <... mkdir resumed>) = 0 [pid 5953] close(3) = 0 [pid 5953] close(4) = 0 [pid 5953] mkdir("./file1", 0777 [pid 5832] <... unlink resumed>) = 0 [pid 5954] munmap(0x7f4761000000, 138412032 [pid 5953] <... mkdir resumed>) = 0 [pid 5833] <... openat resumed>) = 3 [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5954] <... munmap resumed>) = 0 [pid 5833] <... ioctl resumed>) = 0 [pid 5832] getdents64(3, [pid 5833] close(3 [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] close(3 [pid 5833] <... close resumed>) = 0 [pid 5954] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5953] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5954] <... openat resumed>) = 4 [pid 5832] <... close resumed>) = 0 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5954] ioctl(4, LOOP_SET_FD, 3 [pid 5829] <... openat resumed>) = 3 [pid 5829] ioctl(3, LOOP_CLR_FD [pid 5832] rmdir("./9" [pid 5829] <... ioctl resumed>) = 0 [pid 5829] close(3 [pid 5832] <... rmdir resumed>) = 0 [pid 5829] <... close resumed>) = 0 ./strace-static-x86_64: Process 5955 attached [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5955 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5956 attached [pid 5956] set_robust_list(0x5555612166a0, 24 [pid 5955] set_robust_list(0x5555612166a0, 24 [pid 5954] <... ioctl resumed>) = 0 [pid 5832] mkdir("./10", 0777 [pid 5954] close(3 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5956 [pid 5954] <... close resumed>) = 0 [pid 5954] close(4) = 0 [pid 5954] mkdir("./file1", 0777 [pid 5956] <... set_robust_list resumed>) = 0 [pid 5955] <... set_robust_list resumed>) = 0 [pid 5956] chdir("./9" [pid 5832] <... mkdir resumed>) = 0 [pid 5956] <... chdir resumed>) = 0 [pid 5955] chdir("./10" [pid 5954] <... mkdir resumed>) = 0 [pid 5956] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5955] <... chdir resumed>) = 0 [ 103.271791][ T5954] loop2: detected capacity change from 0 to 256 [pid 5954] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5956] <... prctl resumed>) = 0 [pid 5955] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5956] setpgid(0, 0 [pid 5955] <... prctl resumed>) = 0 [pid 5956] <... setpgid resumed>) = 0 [pid 5955] setpgid(0, 0 [pid 5832] <... openat resumed>) = 3 [pid 5955] <... setpgid resumed>) = 0 [pid 5956] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5955] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5956] <... openat resumed>) = 3 [pid 5955] <... openat resumed>) = 3 [pid 5956] write(3, "1000", 4 [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5955] write(3, "1000", 4 [pid 5956] <... write resumed>) = 4 [pid 5955] <... write resumed>) = 4 [pid 5832] <... ioctl resumed>) = 0 [pid 5956] close(3 [pid 5955] close(3 [pid 5832] close(3 [pid 5956] <... close resumed>) = 0 [pid 5955] <... close resumed>) = 0 [pid 5956] symlink("/dev/binderfs", "./binderfs" [pid 5832] <... close resumed>) = 0 [pid 5955] symlink("/dev/binderfs", "./binderfs" [pid 5956] <... symlink resumed>) = 0 [pid 5955] <... symlink resumed>) = 0 executing program executing program [pid 5956] write(1, "executing program\n", 18) = 18 [pid 5955] write(1, "executing program\n", 18 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5956] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5955] <... write resumed>) = 18 ./strace-static-x86_64: Process 5957 attached [pid 5956] <... futex resumed>) = 0 [pid 5955] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5957 [pid 5957] set_robust_list(0x5555612166a0, 24 [pid 5956] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5955] <... futex resumed>) = 0 [pid 5957] <... set_robust_list resumed>) = 0 [pid 5957] chdir("./10") = 0 [pid 5956] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5955] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5957] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5956] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5955] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5957] <... prctl resumed>) = 0 [pid 5956] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5955] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [ 103.345568][ T5953] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5956] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5955] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5957] setpgid(0, 0) = 0 [pid 5957] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5955] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5957] <... openat resumed>) = 3 [pid 5955] <... mmap resumed>) = 0x7f476940f000 [pid 5953] <... mount resumed>) = 0 [pid 5956] <... mmap resumed>) = 0x7f476940f000 [pid 5956] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5955] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5956] <... mprotect resumed>) = 0 [pid 5955] <... mprotect resumed>) = 0 [pid 5956] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5955] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5953] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5953] chdir("./file1") = 0 [pid 5953] openat(AT_FDCWD, "/dev/loop1", O_RDWRexecuting program [pid 5957] write(3, "1000", 4 [pid 5956] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5955] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5953] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5957] <... write resumed>) = 4 [pid 5955] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5953] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5950] <... futex resumed>) = 0 ./strace-static-x86_64: Process 5958 attached [pid 5953] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5950] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5957] close(3 [pid 5958] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5957] <... close resumed>) = 0 [pid 5956] <... clone3 resumed> => {parent_tid=[5958]}, 88) = 5958 [pid 5950] <... futex resumed>) = 0 [pid 5957] symlink("/dev/binderfs", "./binderfs" [pid 5956] rt_sigprocmask(SIG_SETMASK, [], [pid 5958] <... rseq resumed>) = 0 [pid 5955] <... clone3 resumed> => {parent_tid=[5959]}, 88) = 5959 [pid 5958] set_robust_list(0x7f476942f9a0, 24 [pid 5956] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5955] rt_sigprocmask(SIG_SETMASK, [], [pid 5950] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5959 attached [pid 5958] <... set_robust_list resumed>) = 0 [pid 5957] <... symlink resumed>) = 0 [pid 5956] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5955] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5953] <... openat resumed>) = 4 [pid 5958] rt_sigprocmask(SIG_SETMASK, [], [pid 5957] write(1, "executing program\n", 18 [pid 5956] <... futex resumed>) = 0 [pid 5955] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5958] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5957] <... write resumed>) = 18 [pid 5953] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5957] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5953] <... futex resumed>) = 1 [pid 5950] <... futex resumed>) = 0 [pid 5953] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5950] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5953] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5950] <... futex resumed>) = 0 [pid 5958] memfd_create("syzkaller", 0 [pid 5957] <... futex resumed>) = 0 [pid 5956] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5955] <... futex resumed>) = 0 [pid 5954] <... mount resumed>) = 0 [pid 5953] mkdir("./file2", 0777 [ 103.382196][ T5954] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5950] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5959] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5958] <... memfd_create resumed>) = 3 [pid 5957] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5955] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5954] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5959] <... rseq resumed>) = 0 [pid 5958] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5957] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5959] set_robust_list(0x7f476942f9a0, 24) = 0 [pid 5958] <... mmap resumed>) = 0x7f4761000000 [pid 5957] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5954] <... openat resumed>) = 3 [pid 5959] rt_sigprocmask(SIG_SETMASK, [], [pid 5957] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5959] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5957] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5959] memfd_create("syzkaller", 0 [pid 5957] <... mmap resumed>) = 0x7f476940f000 [pid 5959] <... memfd_create resumed>) = 3 [pid 5957] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5959] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5957] <... mprotect resumed>) = 0 [pid 5959] <... mmap resumed>) = 0x7f4761000000 [pid 5957] rt_sigprocmask(SIG_BLOCK, ~[], [ 103.454446][ T5953] exFAT-fs (loop1): error, data size is invalid(9000) [pid 5959] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5957] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5957] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5954] chdir("./file1"./strace-static-x86_64: Process 5960 attached [pid 5958] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5957] <... clone3 resumed> => {parent_tid=[5960]}, 88) = 5960 [pid 5954] <... chdir resumed>) = 0 [pid 5957] rt_sigprocmask(SIG_SETMASK, [], [pid 5954] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5960] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5958] <... write resumed>) = 131072 [pid 5957] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5954] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5950] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5957] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5954] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5950] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5959] <... write resumed>) = 131072 [pid 5957] <... futex resumed>) = 0 [pid 5954] <... futex resumed>) = 1 [pid 5951] <... futex resumed>) = 0 [pid 5950] <... futex resumed>) = 0 [pid 5951] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5954] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5951] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5957] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5950] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5960] <... rseq resumed>) = 0 [pid 5959] munmap(0x7f4761000000, 138412032 [pid 5954] <... openat resumed>) = 4 [pid 5950] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5959] <... munmap resumed>) = 0 [pid 5950] <... mprotect resumed>) = 0 [pid 5960] set_robust_list(0x7f476942f9a0, 24 [pid 5950] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5960] <... set_robust_list resumed>) = 0 [pid 5950] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5960] rt_sigprocmask(SIG_SETMASK, [], [pid 5950] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5960] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5960] memfd_create("syzkaller", 0 [pid 5958] munmap(0x7f4761000000, 138412032 [pid 5954] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5950] <... clone3 resumed> => {parent_tid=[5961]}, 88) = 5961 ./strace-static-x86_64: Process 5961 attached [pid 5960] <... memfd_create resumed>) = 3 [pid 5959] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5958] <... munmap resumed>) = 0 [pid 5954] <... futex resumed>) = 1 [pid 5951] <... futex resumed>) = 0 [pid 5950] rt_sigprocmask(SIG_SETMASK, [], [pid 5961] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5960] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5959] <... openat resumed>) = 4 [pid 5958] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5954] mkdir("./file2", 0777 [pid 5951] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5950] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 103.494801][ T5953] exFAT-fs (loop1): Filesystem has been set read-only [pid 5961] <... rseq resumed>) = 0 [pid 5960] <... mmap resumed>) = 0x7f4761000000 [pid 5959] ioctl(4, LOOP_SET_FD, 3 [pid 5951] <... futex resumed>) = 0 [pid 5950] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5961] set_robust_list(0x7f476940e9a0, 24 [pid 5960] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5958] <... openat resumed>) = 4 [pid 5961] <... set_robust_list resumed>) = 0 [pid 5960] <... write resumed>) = 131072 [pid 5950] <... futex resumed>) = 0 [pid 5958] ioctl(4, LOOP_SET_FD, 3 [pid 5961] rt_sigprocmask(SIG_SETMASK, [], [pid 5950] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5961] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5961] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5953] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5961] <... ioctl resumed>) = 0 [pid 5961] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5950] <... futex resumed>) = 0 [pid 5961] futex(0x7f47695046d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5953] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5961] <... futex resumed>) = ? [pid 5961] +++ killed by SIGSEGV +++ [pid 5951] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5960] munmap(0x7f4761000000, 138412032 [pid 5958] <... ioctl resumed>) = 0 [pid 5960] <... munmap resumed>) = 0 [ 103.534751][ T5954] exFAT-fs (loop2): error, data size is invalid(9000) [ 103.536406][ T5959] loop4: detected capacity change from 0 to 256 [ 103.561020][ T5958] loop0: detected capacity change from 0 to 256 [pid 5958] close(3 [pid 5960] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5958] <... close resumed>) = 0 [pid 5960] <... openat resumed>) = 4 [pid 5958] close(4 [pid 5953] +++ killed by SIGSEGV +++ [pid 5950] +++ killed by SIGSEGV +++ [pid 5958] <... close resumed>) = 0 [pid 5960] ioctl(4, LOOP_SET_FD, 3 [pid 5958] mkdir("./file1", 0777 [pid 5959] <... ioctl resumed>) = 0 [pid 5958] <... mkdir resumed>) = 0 [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5950, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5959] close(3 [pid 5951] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5951] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5958] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5830] umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5951] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5951] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5951] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5951] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5951] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5959] <... close resumed>) = 0 [pid 5959] close(4 [pid 5951] <... clone3 resumed> => {parent_tid=[5962]}, 88) = 5962 [pid 5959] <... close resumed>) = 0 [pid 5951] rt_sigprocmask(SIG_SETMASK, [], [pid 5959] mkdir("./file1", 0777 [pid 5951] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5962 attached [pid 5959] <... mkdir resumed>) = 0 [pid 5951] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5962] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5951] <... futex resumed>) = 0 [pid 5830] <... openat resumed>) = 3 [pid 5962] <... rseq resumed>) = 0 [pid 5951] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5962] set_robust_list(0x7f476940e9a0, 24 [pid 5830] newfstatat(3, "", [pid 5962] <... set_robust_list resumed>) = 0 [pid 5962] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5959] mount("/dev/loop4", "./file1", "exfat", 0, "" [ 103.596341][ T5954] exFAT-fs (loop2): Filesystem has been set read-only [ 103.612489][ T5960] loop3: detected capacity change from 0 to 256 [pid 5962] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080) = 0 [pid 5960] <... ioctl resumed>) = 0 [pid 5958] <... mount resumed>) = 0 [pid 5954] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5960] close(3 [pid 5958] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5954] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5830] getdents64(3, [pid 5960] <... close resumed>) = 0 [pid 5960] close(4 [pid 5958] <... openat resumed>) = 3 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5960] <... close resumed>) = 0 [pid 5958] chdir("./file1" [pid 5830] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5960] mkdir("./file1", 0777 [pid 5958] <... chdir resumed>) = 0 [pid 5960] <... mkdir resumed>) = 0 [pid 5958] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5960] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5958] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5830] <... umount2 resumed>) = 0 [pid 5958] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5958] <... futex resumed>) = 1 [pid 5956] <... futex resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5956] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5958] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5830] newfstatat(AT_FDCWD, "./9/file1", [pid 5956] <... futex resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5956] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 103.668957][ T5958] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 103.672666][ T5959] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5830] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5962] +++ killed by SIGSEGV +++ [pid 5830] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5958] <... openat resumed>) = 4 [pid 5830] newfstatat(4, "", [pid 5958] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5958] <... futex resumed>) = 1 [pid 5956] <... futex resumed>) = 0 [pid 5830] getdents64(4, [pid 5958] mkdir("./file2", 0777 [pid 5956] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5959] <... mount resumed>) = 0 [pid 5959] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5959] chdir("./file1") = 0 [pid 5959] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5959] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5959] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5955] <... futex resumed>) = 0 [pid 5955] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5959] <... futex resumed>) = 0 [pid 5955] <... futex resumed>) = 1 [pid 5959] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5955] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5951] <... futex resumed>) = ? [pid 5956] <... futex resumed>) = 0 [pid 5830] getdents64(4, [pid 5956] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5959] <... openat resumed>) = 4 [pid 5830] close(4 [pid 5959] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5955] <... futex resumed>) = 0 [pid 5955] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 103.766522][ T5958] exFAT-fs (loop0): error, data size is invalid(9000) [ 103.786714][ T5960] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5955] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5959] mkdir("./file2", 0777 [pid 5830] <... close resumed>) = 0 [pid 5958] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5830] rmdir("./9/file1" [pid 5960] <... mount resumed>) = 0 [pid 5958] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5954] +++ killed by SIGSEGV +++ [pid 5951] +++ killed by SIGSEGV +++ [pid 5830] <... rmdir resumed>) = 0 [pid 5960] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5960] chdir("./file1") = 0 [pid 5960] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5960] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5957] <... futex resumed>) = 0 [pid 5960] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5957] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5960] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5957] <... futex resumed>) = 0 [pid 5960] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5957] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5959] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5956] <... futex resumed>) = ? [pid 5955] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5951, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5830] umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5958] +++ killed by SIGSEGV +++ [pid 5955] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5960] <... openat resumed>) = 4 [pid 5959] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5956] +++ killed by SIGSEGV +++ [pid 5955] <... futex resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] newfstatat(AT_FDCWD, "./9/binderfs", [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5956, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [ 103.820275][ T5959] exFAT-fs (loop4): error, data size is invalid(9000) [ 103.828077][ T5958] exFAT-fs (loop0): Filesystem has been set read-only [ 103.853611][ T5959] exFAT-fs (loop4): Filesystem has been set read-only [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5960] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5959] +++ killed by SIGSEGV +++ [pid 5957] <... futex resumed>) = 0 [pid 5955] +++ killed by SIGSEGV +++ [pid 5830] unlink("./9/binderfs" [pid 5829] umount2("./9", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5960] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5957] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5960] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5830] <... unlink resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5960] mkdir("./file2", 0777 [pid 5957] <... futex resumed>) = 0 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5955, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5829] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5957] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] getdents64(3, [pid 5829] <... openat resumed>) = 3 [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] newfstatat(3, "", [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5830] close(3 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] <... close resumed>) = 0 [pid 5829] getdents64(3, [pid 5833] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5833] getdents64(3, [pid 5831] <... openat resumed>) = 3 [pid 5830] rmdir("./9" [pid 5829] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] newfstatat(3, "", [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5833] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... rmdir resumed>) = 0 [pid 5833] <... umount2 resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] mkdir("./10", 0777 [pid 5831] getdents64(3, [pid 5830] <... mkdir resumed>) = 0 [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5831] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./10/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 5830] ioctl(3, LOOP_CLR_FD) = 0 [pid 5830] close(3 [pid 5833] newfstatat(4, "", [pid 5830] <... close resumed>) = 0 [pid 5960] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 103.914278][ T5960] exFAT-fs (loop3): error, data size is invalid(9000) [ 103.952379][ T5960] exFAT-fs (loop3): Filesystem has been set read-only [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5963 attached [pid 5833] getdents64(4, [pid 5829] <... umount2 resumed>) = 0 [pid 5963] set_robust_list(0x5555612166a0, 24 [pid 5957] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5963 [pid 5963] <... set_robust_list resumed>) = 0 [pid 5957] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] getdents64(4, [pid 5963] chdir("./10" [pid 5957] <... futex resumed>) = 0 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5963] <... chdir resumed>) = 0 [pid 5960] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5957] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] close(4 [pid 5963] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5957] <... mmap resumed>) = ? [pid 5833] <... close resumed>) = 0 [pid 5963] <... prctl resumed>) = 0 [pid 5960] +++ killed by SIGSEGV +++ [pid 5957] +++ killed by SIGSEGV +++ [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5957, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5963] setpgid(0, 0 [pid 5833] rmdir("./10/file1" [pid 5963] <... setpgid resumed>) = 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5963] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5833] umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./10/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] unlink("./10/binderfs") = 0 [pid 5833] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5833] close(3) = 0 [pid 5963] <... openat resumed>) = 3 [pid 5829] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] rmdir("./10") = 0 [pid 5963] write(3, "1000", 4 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5963] <... write resumed>) = 4 executing program [pid 5963] close(3 [pid 5829] newfstatat(AT_FDCWD, "./9/file1", [pid 5963] <... close resumed>) = 0 [pid 5963] symlink("/dev/binderfs", "./binderfs" [pid 5831] <... umount2 resumed>) = 0 [pid 5963] <... symlink resumed>) = 0 [pid 5833] mkdir("./11", 0777 [pid 5963] write(1, "executing program\n", 18 [pid 5833] <... mkdir resumed>) = 0 [pid 5832] umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5963] <... write resumed>) = 18 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5963] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... openat resumed>) = 3 [pid 5963] <... futex resumed>) = 0 [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5963] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5833] <... ioctl resumed>) = 0 [pid 5963] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5963] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5833] close(3 [pid 5963] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] <... close resumed>) = 0 [pid 5963] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] umount2("./9/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] newfstatat(AT_FDCWD, "./10/file1", [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5964 attached [pid 5832] newfstatat(3, "", [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5964] set_robust_list(0x5555612166a0, 24 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5964 [pid 5832] getdents64(3, [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... openat resumed>) = 4 [pid 5964] <... set_robust_list resumed>) = 0 [pid 5831] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] newfstatat(4, "", [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5964] chdir("./11" [pid 5963] <... mmap resumed>) = 0x7f476940f000 [pid 5832] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... openat resumed>) = 4 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5964] <... chdir resumed>) = 0 [pid 5963] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5831] newfstatat(4, "", [pid 5829] getdents64(4, [pid 5964] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5963] <... mprotect resumed>) = 0 [pid 5964] <... prctl resumed>) = 0 [pid 5963] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5964] setpgid(0, 0 [pid 5963] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5964] <... setpgid resumed>) = 0 [pid 5831] getdents64(4, [pid 5829] getdents64(4, [pid 5964] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5963] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5964] <... openat resumed>) = 3 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 5965 attached [pid 5964] write(3, "1000", 4 [pid 5831] getdents64(4, [pid 5829] close(4 [pid 5965] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5964] <... write resumed>) = 4 [pid 5963] <... clone3 resumed> => {parent_tid=[5965]}, 88) = 5965 [pid 5965] <... rseq resumed>) = 0 [pid 5964] close(3 [pid 5963] rt_sigprocmask(SIG_SETMASK, [], [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] <... close resumed>) = 0 [pid 5965] set_robust_list(0x7f476942f9a0, 24 [pid 5964] <... close resumed>) = 0 [pid 5963] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... umount2 resumed>) = 0 [pid 5831] close(4 [pid 5829] rmdir("./9/file1" [pid 5965] <... set_robust_list resumed>) = 0 [pid 5964] symlink("/dev/binderfs", "./binderfs" [pid 5963] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5965] rt_sigprocmask(SIG_SETMASK, [], [pid 5964] <... symlink resumed>) = 0 [pid 5832] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... close resumed>) = 0 [pid 5829] <... rmdir resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] rmdir("./10/file1"executing program [pid 5829] umount2("./9/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5965] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5964] write(1, "executing program\n", 18 [pid 5963] <... futex resumed>) = 0 [pid 5832] newfstatat(AT_FDCWD, "./10/file1", [pid 5965] memfd_create("syzkaller", 0 [pid 5964] <... write resumed>) = 18 [pid 5963] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5831] <... rmdir resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5965] <... memfd_create resumed>) = 3 [pid 5964] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] newfstatat(AT_FDCWD, "./9/binderfs", [pid 5965] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5964] <... futex resumed>) = 0 [pid 5965] <... mmap resumed>) = 0x7f4761000000 [pid 5964] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5965] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5964] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5832] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] unlink("./9/binderfs" [pid 5832] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] newfstatat(AT_FDCWD, "./10/binderfs", [pid 5829] <... unlink resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] getdents64(3, [pid 5964] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5832] <... openat resumed>) = 4 [pid 5831] unlink("./10/binderfs" [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] newfstatat(4, "", [pid 5964] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] <... unlink resumed>) = 0 [pid 5829] close(3 [pid 5964] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5832] getdents64(4, [pid 5831] getdents64(3, [pid 5829] <... close resumed>) = 0 [pid 5964] <... mmap resumed>) = 0x7f476940f000 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] rmdir("./9" [pid 5964] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5832] getdents64(4, [pid 5831] close(3 [pid 5964] <... mprotect resumed>) = 0 [pid 5964] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5831] <... close resumed>) = 0 [pid 5829] <... rmdir resumed>) = 0 [pid 5964] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5831] rmdir("./10" [pid 5832] close(4 [pid 5829] mkdir("./10", 0777 [pid 5964] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} => {parent_tid=[5966]}, 88) = 5966 [pid 5964] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5831] <... rmdir resumed>) = 0 [pid 5964] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5964] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 5966 attached [pid 5965] <... write resumed>) = 131072 [pid 5832] <... close resumed>) = 0 [pid 5831] mkdir("./11", 0777 [pid 5829] <... mkdir resumed>) = 0 [pid 5965] munmap(0x7f4761000000, 138412032 [pid 5966] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5965] <... munmap resumed>) = 0 [pid 5832] rmdir("./10/file1" [pid 5831] <... mkdir resumed>) = 0 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5965] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5966] <... rseq resumed>) = 0 [pid 5965] <... openat resumed>) = 4 [pid 5832] <... rmdir resumed>) = 0 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5829] <... openat resumed>) = 3 [pid 5966] set_robust_list(0x7f476942f9a0, 24 [pid 5832] umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... openat resumed>) = 3 [pid 5829] ioctl(3, LOOP_CLR_FD [pid 5966] <... set_robust_list resumed>) = 0 [pid 5965] ioctl(4, LOOP_SET_FD, 3 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5966] rt_sigprocmask(SIG_SETMASK, [], [pid 5829] <... ioctl resumed>) = 0 [pid 5829] close(3 [pid 5966] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] <... ioctl resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 5966] memfd_create("syzkaller", 0 [pid 5831] close(3 [pid 5832] newfstatat(AT_FDCWD, "./10/binderfs", [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5831] <... close resumed>) = 0 [pid 5966] <... memfd_create resumed>) = 3 [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5966] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0./strace-static-x86_64: Process 5968 attached ./strace-static-x86_64: Process 5967 attached ) = 0x7f4761000000 [pid 5965] <... ioctl resumed>) = 0 [pid 5832] unlink("./10/binderfs" [pid 5965] close(3) = 0 [pid 5965] close(4) = 0 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5967 [pid 5966] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5965] mkdir("./file1", 0777 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5968 [pid 5967] set_robust_list(0x5555612166a0, 24 [pid 5966] <... write resumed>) = 131072 [pid 5965] <... mkdir resumed>) = 0 [pid 5832] <... unlink resumed>) = 0 [pid 5968] set_robust_list(0x5555612166a0, 24 [pid 5967] <... set_robust_list resumed>) = 0 [pid 5966] munmap(0x7f4761000000, 138412032 [pid 5965] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 5832] getdents64(3, [pid 5968] <... set_robust_list resumed>) = 0 [pid 5967] chdir("./10" [pid 5966] <... munmap resumed>) = 0 [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5968] chdir("./11" [pid 5967] <... chdir resumed>) = 0 [pid 5966] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5832] close(3 [pid 5967] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5832] <... close resumed>) = 0 [pid 5967] <... prctl resumed>) = 0 [pid 5966] <... openat resumed>) = 4 [pid 5832] rmdir("./10" [pid 5968] <... chdir resumed>) = 0 [pid 5967] setpgid(0, 0) = 0 [pid 5968] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5967] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5966] ioctl(4, LOOP_SET_FD, 3 [pid 5832] <... rmdir resumed>) = 0 [pid 5968] <... prctl resumed>) = 0 [pid 5967] <... openat resumed>) = 3 [pid 5966] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5832] mkdir("./11", 0777 [pid 5968] setpgid(0, 0 [pid 5966] ioctl(4, LOOP_CLR_FD [pid 5968] <... setpgid resumed>) = 0 [pid 5967] write(3, "1000", 4) = 4 [pid 5968] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [ 104.156828][ T5965] loop1: detected capacity change from 0 to 256 [pid 5967] close(3 [pid 5832] <... mkdir resumed>) = 0 [pid 5968] <... openat resumed>) = 3 [pid 5967] <... close resumed>) = 0 [pid 5966] <... ioctl resumed>) = 0 [pid 5968] write(3, "1000", 4 [pid 5967] symlink("/dev/binderfs", "./binderfs" [pid 5968] <... write resumed>) = 4 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 5968] close(3) = 0 [pid 5968] symlink("/dev/binderfs", "./binderfs" [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5966] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 5832] <... ioctl resumed>) = 0 [pid 5967] <... symlink resumed>) = 0 [pid 5966] close(4 [pid 5832] close(3 [pid 5967] write(1, "executing program\n", 18executing program ) = 18 [pid 5967] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5967] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 5967] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5967] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 5967] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5966] <... close resumed>) = 0 [pid 5832] <... close resumed>) = 0 [pid 5967] <... mprotect resumed>) = 0 [pid 5967] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5966] close(3 [pid 5967] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5967] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 5969 attached [pid 5966] <... close resumed>) = 0 [pid 5968] <... symlink resumed>) = 0 [pid 5966] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5966] <... futex resumed>) = 1 [pid 5964] <... futex resumed>) = 0 [pid 5964] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5969] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5967] <... clone3 resumed> => {parent_tid=[5969]}, 88) = 5969 [pid 5966] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5964] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5970 attached [pid 5969] <... rseq resumed>) = 0 [pid 5967] rt_sigprocmask(SIG_SETMASK, [], [pid 5969] set_robust_list(0x7f476942f9a0, 24 [pid 5967] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5969] <... set_robust_list resumed>) = 0 [pid 5967] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5969] rt_sigprocmask(SIG_SETMASK, [], [pid 5967] <... futex resumed>) = 0 [pid 5970] set_robust_list(0x5555612166a0, 24 [pid 5969] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5967] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5968] write(1, "executing program\n", 18 [pid 5966] <... openat resumed>) = 3 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5970 executing program [pid 5970] <... set_robust_list resumed>) = 0 [pid 5969] memfd_create("syzkaller", 0 [pid 5968] <... write resumed>) = 18 [pid 5966] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5969] <... memfd_create resumed>) = 3 [pid 5969] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5969] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 5969] munmap(0x7f4761000000, 138412032) = 0 [pid 5969] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5970] chdir("./11" [pid 5969] <... openat resumed>) = 4 [ 104.257528][ T5965] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5970] <... chdir resumed>) = 0 [pid 5969] ioctl(4, LOOP_SET_FD, 3 [pid 5968] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5966] <... futex resumed>) = 1 [pid 5964] <... futex resumed>) = 0 [pid 5970] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5968] <... futex resumed>) = 0 [pid 5966] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5964] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5970] <... prctl resumed>) = 0 [pid 5968] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5966] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5964] <... futex resumed>) = 0 [pid 5970] setpgid(0, 0 [pid 5968] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5966] mkdir("./file2", 0777 [pid 5964] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5970] <... setpgid resumed>) = 0 [pid 5968] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5966] <... mkdir resumed>) = 0 [pid 5970] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5968] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5970] <... openat resumed>) = 3 [pid 5968] <... mmap resumed>) = 0x7f476940f000 [pid 5966] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5970] write(3, "1000", 4 [pid 5968] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5964] <... futex resumed>) = ? [pid 5968] <... mprotect resumed>) = 0 [pid 5970] <... write resumed>) = 4 [pid 5970] close(3) = 0 [pid 5968] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5966] +++ killed by SIGSEGV +++ [pid 5964] +++ killed by SIGSEGV +++ [pid 5970] symlink("/dev/binderfs", "./binderfs" [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5964, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5970] <... symlink resumed>) = 0 [pid 5833] umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5833] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] getdents64(3, 0x555561217730 /* 5 entries */, 32768) = 144 [pid 5833] umount2("./11/devices.list", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./11/devices.list", [pid 5970] write(1, "executing program\n", 18 [pid 5968] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5965] <... mount resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] unlink("./11/devices.list") = 0 [pid 5833] umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5968] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5833] unlink("./11/binderfs") = 0 [pid 5833] umount2("./11/file2", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./11/file2", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 executing program [pid 5970] <... write resumed>) = 18 [pid 5833] umount2("./11/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5968] <... clone3 resumed> => {parent_tid=[5971]}, 88) = 5971 [pid 5965] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5970] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5969] <... ioctl resumed>) = 0 [pid 5968] rt_sigprocmask(SIG_SETMASK, [], [pid 5970] <... futex resumed>) = 0 [pid 5968] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5970] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5968] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5970] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5968] <... futex resumed>) = 0 [pid 5970] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5969] close(3 [pid 5970] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5968] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5970] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 5971 attached ) = 0x7f476940f000 [pid 5965] <... openat resumed>) = 3 [ 104.315019][ T5969] loop0: detected capacity change from 0 to 256 [pid 5833] openat(AT_FDCWD, "./11/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5971] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5970] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5969] <... close resumed>) = 0 [pid 5965] chdir("./file1" [pid 5833] <... openat resumed>) = 4 [pid 5971] <... rseq resumed>) = 0 [pid 5970] <... mprotect resumed>) = 0 [pid 5969] close(4 [pid 5965] <... chdir resumed>) = 0 [pid 5833] newfstatat(4, "", [pid 5971] set_robust_list(0x7f476942f9a0, 24 [pid 5970] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5969] <... close resumed>) = 0 [pid 5965] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5971] <... set_robust_list resumed>) = 0 [pid 5970] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5969] mkdir("./file1", 0777 [pid 5965] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5833] getdents64(4, [pid 5971] rt_sigprocmask(SIG_SETMASK, [], [pid 5970] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5965] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 ./strace-static-x86_64: Process 5972 attached [pid 5971] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5969] <... mkdir resumed>) = 0 [pid 5965] <... futex resumed>) = 1 [pid 5963] <... futex resumed>) = 0 [pid 5833] getdents64(4, [pid 5972] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5971] memfd_create("syzkaller", 0 [pid 5970] <... clone3 resumed> => {parent_tid=[5972]}, 88) = 5972 [pid 5969] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5965] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5963] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5972] <... rseq resumed>) = 0 [pid 5971] <... memfd_create resumed>) = 3 [pid 5965] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5963] <... futex resumed>) = 0 [pid 5833] close(4 [pid 5971] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5965] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5963] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... close resumed>) = 0 [pid 5972] set_robust_list(0x7f476942f9a0, 24) = 0 [pid 5971] <... mmap resumed>) = 0x7f4761000000 [pid 5970] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] rmdir("./11/file2" [pid 5972] rt_sigprocmask(SIG_SETMASK, [], [pid 5971] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5970] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5972] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5972] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5965] <... openat resumed>) = 4 [pid 5833] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5833] close(3) = 0 [pid 5971] <... write resumed>) = 131072 [pid 5970] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5972] <... futex resumed>) = 0 [pid 5970] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5972] memfd_create("syzkaller", 0 [pid 5833] rmdir("./11" [pid 5971] munmap(0x7f4761000000, 138412032 [pid 5965] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5972] <... memfd_create resumed>) = 3 [pid 5971] <... munmap resumed>) = 0 [pid 5965] <... futex resumed>) = 1 [pid 5963] <... futex resumed>) = 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5972] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5963] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] mkdir("./12", 0777 [pid 5972] <... mmap resumed>) = 0x7f4761000000 [pid 5971] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5965] mkdir("./file2", 0777 [pid 5963] <... futex resumed>) = 0 [pid 5972] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5971] <... openat resumed>) = 4 [pid 5963] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... mkdir resumed>) = 0 [pid 5972] <... write resumed>) = 131072 [pid 5971] ioctl(4, LOOP_SET_FD, 3 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5972] munmap(0x7f4761000000, 138412032 [pid 5833] <... openat resumed>) = 3 [pid 5833] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [ 104.442670][ T5965] exFAT-fs (loop1): error, data size is invalid(9000) [ 104.464554][ T5971] loop2: detected capacity change from 0 to 256 [ 104.475609][ T5969] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5833] close(3 [pid 5972] <... munmap resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 5972] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5973 attached [pid 5972] <... openat resumed>) = 4 [pid 5973] set_robust_list(0x5555612166a0, 24 [pid 5972] ioctl(4, LOOP_SET_FD, 3 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5973 [pid 5973] <... set_robust_list resumed>) = 0 [pid 5963] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5963] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5963] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5973] chdir("./12" [pid 5971] <... ioctl resumed>) = 0 [pid 5963] <... mmap resumed>) = 0x7f47693ee000 [pid 5973] <... chdir resumed>) = 0 [pid 5971] close(3 [pid 5969] <... mount resumed>) = 0 [pid 5965] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5963] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5973] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5972] <... ioctl resumed>) = 0 [pid 5971] <... close resumed>) = 0 [pid 5963] <... mprotect resumed>) = 0 [ 104.497148][ T5965] exFAT-fs (loop1): Filesystem has been set read-only [ 104.515677][ T5972] loop3: detected capacity change from 0 to 256 [pid 5973] <... prctl resumed>) = 0 [pid 5972] close(3 [pid 5971] close(4 [pid 5969] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5965] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5963] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5973] setpgid(0, 0 [pid 5972] <... close resumed>) = 0 [pid 5971] <... close resumed>) = 0 [pid 5969] <... openat resumed>) = 3 [pid 5963] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5972] close(4 [pid 5971] mkdir("./file1", 0777 [pid 5963] mkdir("./file1", 0777 [pid 5973] <... setpgid resumed>) = 0 [pid 5972] <... close resumed>) = 0 [pid 5971] <... mkdir resumed>) = 0 [pid 5969] chdir("./file1" [pid 5972] mkdir("./file1", 0777 [pid 5973] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5972] <... mkdir resumed>) = 0 [pid 5971] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5969] <... chdir resumed>) = 0 [pid 5973] <... openat resumed>) = 3 [pid 5972] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5965] +++ killed by SIGSEGV +++ [pid 5963] +++ killed by SIGSEGV +++ [pid 5969] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5963, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5830] umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5830] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5830] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5969] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5969] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5969] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5967] <... futex resumed>) = 0 [pid 5967] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5969] <... futex resumed>) = 0 [pid 5969] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5973] write(3, "1000", 4 [pid 5967] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5973] <... write resumed>) = 4 [pid 5973] close(3) = 0 [pid 5973] symlink("/dev/binderfs", "./binderfs" [pid 5969] <... openat resumed>) = 4 [pid 5969] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5967] <... futex resumed>) = 0 [pid 5967] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5967] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5973] <... symlink resumed>) = 0 [pid 5969] mkdir("./file2", 0777 [ 104.589026][ T5971] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 104.629769][ T5969] exFAT-fs (loop0): error, data size is invalid(9000) [pid 5973] write(1, "executing program\n", 18executing program ) = 18 [pid 5971] <... mount resumed>) = 0 [pid 5971] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5971] chdir("./file1") = 0 [pid 5971] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5971] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5968] <... futex resumed>) = 0 [pid 5971] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5968] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5968] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5969] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5969] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5967] <... futex resumed>) = ? [pid 5973] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5969] +++ killed by SIGSEGV +++ [pid 5967] +++ killed by SIGSEGV +++ [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5967, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5829] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5973] <... futex resumed>) = 0 [pid 5973] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5830] <... umount2 resumed>) = 0 [pid 5829] umount2("./10", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [ 104.642633][ T5969] exFAT-fs (loop0): Filesystem has been set read-only [ 104.655997][ T5972] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5829] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5973] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5830] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] newfstatat(3, "", [pid 5973] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5971] <... openat resumed>) = 4 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5973] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5971] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] newfstatat(AT_FDCWD, "./10/file1", [pid 5829] getdents64(3, [pid 5973] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5971] <... futex resumed>) = 1 [pid 5968] <... futex resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5973] <... mmap resumed>) = 0x7f476940f000 [pid 5971] mkdir("./file2", 0777 [pid 5968] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5973] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5972] <... mount resumed>) = 0 [pid 5973] <... mprotect resumed>) = 0 [pid 5972] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5968] <... futex resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... umount2 resumed>) = 0 [pid 5972] <... openat resumed>) = 3 [pid 5968] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... openat resumed>) = 4 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5972] chdir("./file1" [pid 5830] newfstatat(4, "", [pid 5829] newfstatat(AT_FDCWD, "./10/file1", [pid 5973] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5972] <... chdir resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5972] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5830] getdents64(4, [pid 5829] umount2("./10/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5973] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5972] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5972] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5973] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5972] <... futex resumed>) = 1 [pid 5970] <... futex resumed>) = 0 [pid 5830] getdents64(4, [pid 5829] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5972] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5970] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5972] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] <... openat resumed>) = 4 [pid 5973] <... clone3 resumed> => {parent_tid=[5974]}, 88) = 5974 [pid 5830] close(4 [pid 5829] newfstatat(4, "", [pid 5972] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5970] <... futex resumed>) = 0 [pid 5973] rt_sigprocmask(SIG_SETMASK, [], [pid 5970] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] <... close resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5973] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5830] rmdir("./10/file1" [pid 5829] getdents64(4, [pid 5973] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5830] <... rmdir resumed>) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5973] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5830] umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [ 104.696919][ T5971] exFAT-fs (loop2): error, data size is invalid(9000) [pid 5829] getdents64(4, ./strace-static-x86_64: Process 5974 attached [pid 5972] <... openat resumed>) = 4 [pid 5971] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] newfstatat(AT_FDCWD, "./10/binderfs", [pid 5829] close(4 [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] <... close resumed>) = 0 [pid 5972] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5971] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5830] unlink("./10/binderfs" [pid 5974] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5968] <... futex resumed>) = ? [pid 5830] <... unlink resumed>) = 0 [pid 5829] rmdir("./10/file1" [pid 5971] +++ killed by SIGSEGV +++ [pid 5970] <... futex resumed>) = 0 [pid 5968] +++ killed by SIGSEGV +++ [pid 5830] getdents64(3, [pid 5829] <... rmdir resumed>) = 0 [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] umount2("./10/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5968, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5830] close(3 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] restart_syscall(<... resuming interrupted clone ...> [pid 5830] <... close resumed>) = 0 [pid 5829] newfstatat(AT_FDCWD, "./10/binderfs", [pid 5830] rmdir("./10" [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5974] <... rseq resumed>) = 0 [pid 5972] <... futex resumed>) = 1 [pid 5970] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... rmdir resumed>) = 0 [pid 5829] unlink("./10/binderfs" [pid 5974] set_robust_list(0x7f476942f9a0, 24 [pid 5972] mkdir("./file2", 0777 [pid 5970] <... futex resumed>) = 0 [pid 5830] mkdir("./11", 0777 [pid 5829] <... unlink resumed>) = 0 [pid 5974] <... set_robust_list resumed>) = 0 [pid 5831] <... restart_syscall resumed>) = 0 [pid 5830] <... mkdir resumed>) = 0 [pid 5829] getdents64(3, [pid 5974] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 104.755788][ T5971] exFAT-fs (loop2): Filesystem has been set read-only [ 104.781860][ T5972] exFAT-fs (loop3): error, data size is invalid(9000) [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5974] memfd_create("syzkaller", 0 [pid 5970] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5974] <... memfd_create resumed>) = 3 [pid 5831] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] <... openat resumed>) = 3 [pid 5829] close(3 [pid 5974] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5972] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5831] <... openat resumed>) = 3 [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5829] <... close resumed>) = 0 [pid 5974] <... mmap resumed>) = 0x7f4761000000 [pid 5972] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5831] newfstatat(3, "", [pid 5830] <... ioctl resumed>) = 0 [ 104.795205][ T5972] exFAT-fs (loop3): Filesystem has been set read-only [pid 5974] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5970] <... futex resumed>) = ? [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] close(3 [pid 5829] rmdir("./10" [pid 5972] +++ killed by SIGSEGV +++ [pid 5970] +++ killed by SIGSEGV +++ [pid 5831] getdents64(3, [pid 5830] <... close resumed>) = 0 [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5975 attached [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5970, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5831] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] mkdir("./11", 0777 [pid 5975] set_robust_list(0x5555612166a0, 24 [pid 5832] restart_syscall(<... resuming interrupted clone ...> [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5975 [pid 5829] <... mkdir resumed>) = 0 [pid 5975] <... set_robust_list resumed>) = 0 [pid 5974] <... write resumed>) = 131072 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 5832] <... restart_syscall resumed>) = 0 [pid 5975] chdir("./11" [pid 5829] ioctl(3, LOOP_CLR_FD [pid 5975] <... chdir resumed>) = 0 [pid 5832] umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... ioctl resumed>) = 0 [pid 5975] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5974] munmap(0x7f4761000000, 138412032 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] close(3 [pid 5975] <... prctl resumed>) = 0 [pid 5974] <... munmap resumed>) = 0 [pid 5832] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] <... close resumed>) = 0 [pid 5975] setpgid(0, 0 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5976 attached [pid 5975] <... setpgid resumed>) = 0 [pid 5974] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5832] <... openat resumed>) = 3 [pid 5975] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5974] <... openat resumed>) = 4 [pid 5832] newfstatat(3, "", [pid 5975] <... openat resumed>) = 3 [pid 5974] ioctl(4, LOOP_SET_FD, 3 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5976] set_robust_list(0x5555612166a0, 24 [pid 5832] getdents64(3, [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5976 [pid 5976] <... set_robust_list resumed>) = 0 [pid 5976] chdir("./11" [pid 5975] write(3, "1000", 4 [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5831] <... umount2 resumed>) = 0 [pid 5976] <... chdir resumed>) = 0 [pid 5975] <... write resumed>) = 4 [pid 5832] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5976] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5975] close(3 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5976] <... prctl resumed>) = 0 [pid 5975] <... close resumed>) = 0 [pid 5831] newfstatat(AT_FDCWD, "./11/file1", [pid 5976] setpgid(0, 0 [pid 5975] symlink("/dev/binderfs", "./binderfs" [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5976] <... setpgid resumed>) = 0 [pid 5975] <... symlink resumed>) = 0 [pid 5976] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXECexecuting program executing program ) = 3 [pid 5975] write(1, "executing program\n", 18 [pid 5831] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5975] <... write resumed>) = 18 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5975] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5975] <... futex resumed>) = 0 [pid 5975] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5831] <... openat resumed>) = 4 [pid 5975] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5831] newfstatat(4, "", [pid 5975] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5976] write(3, "1000", 4 [pid 5975] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] close(4 [pid 5976] <... write resumed>) = 4 [pid 5975] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5831] <... close resumed>) = 0 [pid 5976] close(3 [pid 5975] <... mmap resumed>) = 0x7f476940f000 [pid 5976] <... close resumed>) = 0 [pid 5831] rmdir("./11/file1" [pid 5976] symlink("/dev/binderfs", "./binderfs" [pid 5975] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5976] <... symlink resumed>) = 0 [pid 5831] <... rmdir resumed>) = 0 [pid 5976] write(1, "executing program\n", 18 [pid 5975] <... mprotect resumed>) = 0 [pid 5976] <... write resumed>) = 18 [pid 5975] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5976] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5975] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5976] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5975] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5831] umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5977 attached ) = -1 EINVAL (Invalid argument) [pid 5975] <... clone3 resumed> => {parent_tid=[5977]}, 88) = 5977 [pid 5831] newfstatat(AT_FDCWD, "./11/binderfs", [pid 5977] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5975] rt_sigprocmask(SIG_SETMASK, [], [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5977] <... rseq resumed>) = 0 [pid 5976] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5975] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... umount2 resumed>) = 0 [pid 5831] unlink("./11/binderfs" [pid 5977] set_robust_list(0x7f476942f9a0, 24 [pid 5976] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5975] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5974] <... ioctl resumed>) = 0 [pid 5831] <... unlink resumed>) = 0 [pid 5977] <... set_robust_list resumed>) = 0 [pid 5976] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5975] <... futex resumed>) = 0 [pid 5977] rt_sigprocmask(SIG_SETMASK, [], [pid 5976] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5975] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5831] getdents64(3, [pid 5977] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5976] <... mmap resumed>) = 0x7f476940f000 [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5977] memfd_create("syzkaller", 0 [pid 5976] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5832] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] close(3 [pid 5977] <... memfd_create resumed>) = 3 [pid 5976] <... mprotect resumed>) = 0 [pid 5974] close(3 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... close resumed>) = 0 [pid 5977] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5976] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5974] <... close resumed>) = 0 [pid 5832] newfstatat(AT_FDCWD, "./11/file1", [pid 5831] rmdir("./11" [pid 5977] <... mmap resumed>) = 0x7f4761000000 [pid 5976] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5974] close(4 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 104.870427][ T5974] loop4: detected capacity change from 0 to 256 [pid 5831] <... rmdir resumed>) = 0 [pid 5977] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5976] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5974] <... close resumed>) = 0 [pid 5832] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5978 attached [pid 5978] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5974] mkdir("./file1", 0777 [pid 5832] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5978] <... rseq resumed>) = 0 [pid 5974] <... mkdir resumed>) = 0 [pid 5832] <... openat resumed>) = 4 [pid 5831] mkdir("./12", 0777 [pid 5978] set_robust_list(0x7f476942f9a0, 24 [pid 5977] <... write resumed>) = 131072 [pid 5976] <... clone3 resumed> => {parent_tid=[5978]}, 88) = 5978 [pid 5974] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5832] newfstatat(4, "", [pid 5831] <... mkdir resumed>) = 0 [pid 5978] <... set_robust_list resumed>) = 0 [pid 5976] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5978] rt_sigprocmask(SIG_SETMASK, [], [pid 5977] munmap(0x7f4761000000, 138412032 [pid 5976] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] getdents64(4, [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5978] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5977] <... munmap resumed>) = 0 [pid 5976] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] <... openat resumed>) = 3 [pid 5978] memfd_create("syzkaller", 0 [pid 5976] <... futex resumed>) = 0 [pid 5832] getdents64(4, [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5978] <... memfd_create resumed>) = 3 [pid 5976] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5831] <... ioctl resumed>) = 0 [pid 5978] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5977] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5832] close(4 [pid 5831] close(3 [pid 5978] <... mmap resumed>) = 0x7f4761000000 [pid 5977] <... openat resumed>) = 4 [pid 5832] <... close resumed>) = 0 [pid 5831] <... close resumed>) = 0 [pid 5977] ioctl(4, LOOP_SET_FD, 3 [pid 5832] rmdir("./11/file1" [pid 5978] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5832] <... rmdir resumed>) = 0 [pid 5978] <... write resumed>) = 131072 [pid 5832] umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5978] munmap(0x7f4761000000, 138412032 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5978] <... munmap resumed>) = 0 [pid 5832] newfstatat(AT_FDCWD, "./11/binderfs", [pid 5978] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] unlink("./11/binderfs") = 0 [pid 5832] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] close(3) = 0 [pid 5832] rmdir("./11"./strace-static-x86_64: Process 5979 attached ) = 0 [pid 5978] <... openat resumed>) = 4 [pid 5979] set_robust_list(0x5555612166a0, 24 [pid 5978] ioctl(4, LOOP_SET_FD, 3 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5979 [ 104.978612][ T5977] loop1: detected capacity change from 0 to 256 [ 104.998156][ T5974] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5832] mkdir("./12", 0777) = 0 [pid 5977] <... ioctl resumed>) = 0 [pid 5977] close(3) = 0 [pid 5977] close(4) = 0 [pid 5977] mkdir("./file1", 0777 [pid 5979] <... set_robust_list resumed>) = 0 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 5832] ioctl(3, LOOP_CLR_FD) = 0 [pid 5832] close(3 [pid 5979] chdir("./12" [pid 5977] <... mkdir resumed>) = 0 [pid 5979] <... chdir resumed>) = 0 [pid 5979] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5977] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 5832] <... close resumed>) = 0 [pid 5979] <... prctl resumed>) = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5979] setpgid(0, 0) = 0 ./strace-static-x86_64: Process 5980 attached [pid 5979] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5980] set_robust_list(0x5555612166a0, 24) = 0 [pid 5979] <... openat resumed>) = 3 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5980 [pid 5979] write(3, "1000", 4 [pid 5980] chdir("./12" [pid 5979] <... write resumed>) = 4 [pid 5974] <... mount resumed>) = 0 [ 105.020270][ T5978] loop0: detected capacity change from 0 to 256 [pid 5980] <... chdir resumed>) = 0 [pid 5979] close(3 [pid 5980] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5980] setpgid(0, 0) = 0 [pid 5980] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5980] write(3, "1000", 4) = 4 [pid 5980] close(3) = 0 [pid 5979] <... close resumed>) = 0 [pid 5978] <... ioctl resumed>) = 0 [pid 5974] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5980] symlink("/dev/binderfs", "./binderfs" [pid 5979] symlink("/dev/binderfs", "./binderfs" [pid 5978] close(3executing program [pid 5980] <... symlink resumed>) = 0 [pid 5978] <... close resumed>) = 0 [pid 5980] write(1, "executing program\n", 18 [pid 5979] <... symlink resumed>) = 0 [pid 5978] close(4 [pid 5980] <... write resumed>) = 18 [pid 5974] <... openat resumed>) = 3 [pid 5980] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5974] chdir("./file1") = 0 [pid 5974] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5974] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5973] <... futex resumed>) = 0 [pid 5973] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5973] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5980] <... futex resumed>) = 0 [pid 5974] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5980] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 5980] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5980] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 5980] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5980] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5979] write(1, "executing program\n", 18 [pid 5978] <... close resumed>) = 0 executing program [pid 5978] mkdir("./file1", 0777 [pid 5979] <... write resumed>) = 18 [pid 5974] <... openat resumed>) = 4 [pid 5980] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5980] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} => {parent_tid=[5981]}, 88) = 5981 [pid 5980] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5980] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5980] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5974] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5973] <... futex resumed>) = 0 [pid 5978] <... mkdir resumed>) = 0 [pid 5973] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5979] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5981 attached [pid 5978] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5973] <... futex resumed>) = 0 [pid 5973] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5974] <... futex resumed>) = 1 [ 105.085283][ T5977] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 105.120787][ T5974] exFAT-fs (loop4): error, data size is invalid(9000) [pid 5974] mkdir("./file2", 0777 [pid 5981] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5979] <... futex resumed>) = 0 [pid 5977] <... mount resumed>) = 0 [pid 5977] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5977] chdir("./file1") = 0 [pid 5977] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 5977] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5977] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5975] <... futex resumed>) = 0 [pid 5975] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5977] <... futex resumed>) = 0 [pid 5975] <... futex resumed>) = 1 [pid 5977] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5975] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5977] <... openat resumed>) = 4 [pid 5977] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5975] <... futex resumed>) = 0 [pid 5975] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5975] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5977] mkdir("./file2", 0777 [pid 5981] <... rseq resumed>) = 0 [pid 5979] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5981] set_robust_list(0x7f476942f9a0, 24 [pid 5979] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5981] <... set_robust_list resumed>) = 0 [pid 5979] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5981] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5979] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5978] <... mount resumed>) = 0 [pid 5973] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5979] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5973] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5979] <... mmap resumed>) = 0x7f476940f000 [pid 5973] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5979] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5974] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5981] memfd_create("syzkaller", 0 [pid 5979] <... mprotect resumed>) = 0 [pid 5973] <... mmap resumed>) = 0x7f47693ee000 [pid 5979] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5974] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5979] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5981] <... memfd_create resumed>) = 3 [pid 5979] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5975] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5981] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5978] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5975] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5975] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5975] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5975] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5975] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} => {parent_tid=[5982]}, 88) = 5982 [pid 5975] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5975] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5975] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5982 attached [pid 5982] rseq(0x7f476940efe0, 0x20, 0, 0x53053053./strace-static-x86_64: Process 5983 attached ) = 0 [pid 5981] <... mmap resumed>) = 0x7f4761000000 [pid 5979] <... clone3 resumed> => {parent_tid=[5983]}, 88) = 5983 [pid 5978] <... openat resumed>) = 3 [pid 5974] +++ killed by SIGSEGV +++ [pid 5973] +++ killed by SIGSEGV +++ [pid 5983] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5978] chdir("./file1" [pid 5979] rt_sigprocmask(SIG_SETMASK, [], [pid 5983] <... rseq resumed>) = 0 [pid 5982] set_robust_list(0x7f476940e9a0, 24) = 0 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5973, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5982] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] restart_syscall(<... resuming interrupted clone ...> [pid 5982] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5982] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5977] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5983] set_robust_list(0x7f476942f9a0, 24 [pid 5982] <... ioctl resumed>) = 0 [pid 5981] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5979] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5978] <... chdir resumed>) = 0 [pid 5833] <... restart_syscall resumed>) = 0 [pid 5983] <... set_robust_list resumed>) = 0 [ 105.142347][ T5974] exFAT-fs (loop4): Filesystem has been set read-only [ 105.157006][ T5977] exFAT-fs (loop1): error, data size is invalid(9000) [ 105.165351][ T5977] exFAT-fs (loop1): Filesystem has been set read-only [ 105.175950][ T5978] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5982] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5983] rt_sigprocmask(SIG_SETMASK, [], [pid 5982] <... futex resumed>) = 1 [pid 5979] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5978] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5975] <... futex resumed>) = 0 [pid 5983] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5982] futex(0x7f47695046d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5979] <... futex resumed>) = 0 [pid 5833] umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5983] memfd_create("syzkaller", 0 [pid 5979] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5978] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5977] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5983] <... memfd_create resumed>) = 3 [pid 5982] <... futex resumed>) = ? [pid 5978] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5983] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5982] +++ killed by SIGSEGV +++ [pid 5978] <... futex resumed>) = 1 [pid 5977] +++ killed by SIGSEGV +++ [pid 5976] <... futex resumed>) = 0 [pid 5975] +++ killed by SIGSEGV +++ [pid 5833] <... openat resumed>) = 3 [pid 5976] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] newfstatat(3, "", [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5975, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5978] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5976] <... futex resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5976] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5983] <... mmap resumed>) = 0x7f4761000000 [pid 5830] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5983] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5981] <... write resumed>) = 131072 [pid 5978] <... openat resumed>) = 4 [pid 5830] <... openat resumed>) = 3 [pid 5830] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5981] munmap(0x7f4761000000, 138412032 [pid 5978] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5976] <... futex resumed>) = 0 [pid 5976] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5976] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5981] <... munmap resumed>) = 0 [pid 5978] mkdir("./file2", 0777 [pid 5833] <... umount2 resumed>) = 0 [pid 5833] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./12/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5833] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5833] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5833] close(4) = 0 [pid 5833] rmdir("./12/file1") = 0 [pid 5983] <... write resumed>) = 131072 [pid 5981] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5833] umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] unlink("./12/binderfs") = 0 [pid 5833] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5833] close(3 [pid 5981] <... openat resumed>) = 4 [pid 5833] <... close resumed>) = 0 [pid 5833] rmdir("./12" [pid 5983] munmap(0x7f4761000000, 138412032 [pid 5981] ioctl(4, LOOP_SET_FD, 3 [pid 5833] <... rmdir resumed>) = 0 [pid 5833] mkdir("./13", 0777) = 0 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 5833] ioctl(3, LOOP_CLR_FD) = 0 [pid 5833] close(3) = 0 [ 105.261003][ T5978] exFAT-fs (loop0): error, data size is invalid(9000) [ 105.277256][ T5981] loop3: detected capacity change from 0 to 256 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5983] <... munmap resumed>) = 0 [pid 5981] <... ioctl resumed>) = 0 [pid 5830] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 5984 attached [pid 5983] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5981] close(3 [pid 5976] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 105.304332][ T5978] exFAT-fs (loop0): Filesystem has been set read-only [pid 5983] <... openat resumed>) = 4 [pid 5981] <... close resumed>) = 0 [pid 5976] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5984 [pid 5830] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5976] <... futex resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5976] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5830] newfstatat(AT_FDCWD, "./11/file1", [pid 5976] <... mmap resumed>) = 0x7f47693ee000 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5976] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5830] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5976] <... mprotect resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5983] ioctl(4, LOOP_SET_FD, 3 [pid 5981] close(4 [pid 5976] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5830] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5976] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5830] <... openat resumed>) = 4 [pid 5976] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5830] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5976] <... clone3 resumed> => {parent_tid=[5985]}, 88) = 5985 [pid 5830] getdents64(4, [pid 5976] rt_sigprocmask(SIG_SETMASK, [], [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5976] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5830] getdents64(4, [pid 5976] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5976] <... futex resumed>) = 0 [pid 5830] close(4 [pid 5976] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] <... close resumed>) = 0 ./strace-static-x86_64: Process 5985 attached [pid 5830] rmdir("./11/file1" [pid 5985] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5981] <... close resumed>) = 0 [pid 5978] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5978] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5985] <... rseq resumed>) = ? [pid 5976] <... futex resumed>) = ? [pid 5830] <... rmdir resumed>) = 0 [pid 5985] +++ killed by SIGSEGV +++ [pid 5983] <... ioctl resumed>) = 0 [pid 5981] mkdir("./file1", 0777 [pid 5978] +++ killed by SIGSEGV +++ [pid 5976] +++ killed by SIGSEGV +++ [pid 5984] set_robust_list(0x5555612166a0, 24 [pid 5830] umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5976, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] umount2("./11", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5984] <... set_robust_list resumed>) = 0 [pid 5981] <... mkdir resumed>) = 0 [pid 5830] unlink("./11/binderfs" [pid 5981] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5984] chdir("./13" [pid 5829] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5984] <... chdir resumed>) = 0 [pid 5830] <... unlink resumed>) = 0 [pid 5829] newfstatat(3, "", [pid 5984] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5984] setpgid(0, 0) = 0 [pid 5830] getdents64(3, [ 105.353663][ T5983] loop2: detected capacity change from 0 to 256 [pid 5829] getdents64(3, [pid 5984] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5983] close(3 [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5984] <... openat resumed>) = 3 [pid 5983] <... close resumed>) = 0 [pid 5829] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5984] write(3, "1000", 4) = 4 [pid 5983] close(4 [pid 5830] close(3 [pid 5829] <... umount2 resumed>) = 0 [pid 5830] <... close resumed>) = 0 [pid 5829] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] rmdir("./11" [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... rmdir resumed>) = 0 [pid 5829] newfstatat(AT_FDCWD, "./11/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] umount2("./11/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5829] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] mkdir("./12", 0777 [pid 5829] <... openat resumed>) = 4 [pid 5830] <... mkdir resumed>) = 0 [pid 5829] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] close(4) = 0 [pid 5829] rmdir("./11/file1" [pid 5984] close(3 [pid 5829] <... rmdir resumed>) = 0 [pid 5984] <... close resumed>) = 0 [pid 5983] <... close resumed>) = 0 [pid 5984] symlink("/dev/binderfs", "./binderfs" [pid 5983] mkdir("./file1", 0777 [pid 5984] <... symlink resumed>) = 0 [pid 5983] <... mkdir resumed>) = 0 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5984] write(1, "executing program\n", 18 [pid 5983] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5830] <... openat resumed>) = 3 [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5829] umount2("./11/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... ioctl resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) executing program [pid 5830] close(3 [pid 5829] newfstatat(AT_FDCWD, "./11/binderfs", [pid 5830] <... close resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] unlink("./11/binderfs" [pid 5984] <... write resumed>) = 18 [pid 5829] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 5986 attached [pid 5984] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5984] <... futex resumed>) = 0 [pid 5829] close(3 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5986 [pid 5829] <... close resumed>) = 0 [pid 5986] set_robust_list(0x5555612166a0, 24 [pid 5829] rmdir("./11") = 0 [pid 5984] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5986] <... set_robust_list resumed>) = 0 [pid 5986] chdir("./12" [pid 5984] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5986] <... chdir resumed>) = 0 [pid 5984] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [ 105.402269][ T5981] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5829] mkdir("./12", 0777 [pid 5984] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5986] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5829] <... mkdir resumed>) = 0 [pid 5984] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5986] <... prctl resumed>) = 0 [pid 5984] <... mmap resumed>) = 0x7f476940f000 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5986] setpgid(0, 0 [pid 5984] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5829] <... openat resumed>) = 3 [pid 5986] <... setpgid resumed>) = 0 [pid 5984] <... mprotect resumed>) = 0 [pid 5986] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5829] ioctl(3, LOOP_CLR_FD [pid 5986] <... openat resumed>) = 3 [pid 5984] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5829] <... ioctl resumed>) = 0 [pid 5986] write(3, "1000", 4 [pid 5984] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5981] <... mount resumed>) = 0 [pid 5829] close(3 [pid 5984] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 5987 attached [pid 5986] <... write resumed>) = 4 [pid 5981] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5986] close(3) = 0 [pid 5986] symlink("/dev/binderfs", "./binderfs"executing program ) = 0 [pid 5986] write(1, "executing program\n", 18) = 18 [pid 5986] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5984] <... clone3 resumed> => {parent_tid=[5987]}, 88) = 5987 [pid 5986] <... futex resumed>) = 0 [pid 5987] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5986] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5984] rt_sigprocmask(SIG_SETMASK, [], [pid 5981] <... openat resumed>) = 3 [pid 5986] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5986] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5986] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5987] <... rseq resumed>) = 0 [pid 5986] <... mmap resumed>) = 0x7f476940f000 [pid 5984] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5981] chdir("./file1" [pid 5987] set_robust_list(0x7f476942f9a0, 24 [pid 5986] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5984] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5981] <... chdir resumed>) = 0 [pid 5987] <... set_robust_list resumed>) = 0 [pid 5986] <... mprotect resumed>) = 0 [pid 5984] <... futex resumed>) = 0 [pid 5981] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5987] rt_sigprocmask(SIG_SETMASK, [], [pid 5986] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5984] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5981] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5987] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 105.513076][ T5983] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5981] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... close resumed>) = 0 [pid 5987] memfd_create("syzkaller", 0 [pid 5986] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5981] <... futex resumed>) = 1 [pid 5980] <... futex resumed>) = 0 [pid 5981] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5980] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5981] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5980] <... futex resumed>) = 0 [pid 5981] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5987] <... memfd_create resumed>) = 3 [pid 5986] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5980] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 5988 attached [pid 5987] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5988] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5987] <... mmap resumed>) = 0x7f4761000000 [pid 5986] <... clone3 resumed> => {parent_tid=[5988]}, 88) = 5988 [pid 5983] <... mount resumed>) = 0 [pid 5981] <... openat resumed>) = 4 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5981] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 5989 attached [pid 5988] <... rseq resumed>) = 0 [pid 5987] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5986] rt_sigprocmask(SIG_SETMASK, [], [pid 5983] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5981] <... futex resumed>) = 1 [pid 5980] <... futex resumed>) = 0 [pid 5988] set_robust_list(0x7f476942f9a0, 24 [pid 5986] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5983] <... openat resumed>) = 3 [pid 5981] mkdir("./file2", 0777 [pid 5980] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 5989 [pid 5988] <... set_robust_list resumed>) = 0 [pid 5986] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5988] rt_sigprocmask(SIG_SETMASK, [], [pid 5986] <... futex resumed>) = 0 [pid 5988] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5986] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5988] memfd_create("syzkaller", 0) = 3 [pid 5988] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5988] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5989] set_robust_list(0x5555612166a0, 24 [pid 5983] chdir("./file1" [pid 5980] <... futex resumed>) = 0 [pid 5989] <... set_robust_list resumed>) = 0 [pid 5988] <... write resumed>) = 131072 [pid 5987] <... write resumed>) = 131072 [pid 5983] <... chdir resumed>) = 0 [pid 5980] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5989] chdir("./12") = 0 [pid 5987] munmap(0x7f4761000000, 138412032 [pid 5983] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5988] munmap(0x7f4761000000, 138412032 [pid 5987] <... munmap resumed>) = 0 [pid 5989] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5988] <... munmap resumed>) = 0 [pid 5987] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5983] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5987] <... openat resumed>) = 4 [pid 5987] ioctl(4, LOOP_SET_FD, 3 [pid 5988] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [ 105.604024][ T5981] exFAT-fs (loop3): error, data size is invalid(9000) [ 105.636224][ T5987] loop4: detected capacity change from 0 to 256 [pid 5989] <... prctl resumed>) = 0 [pid 5988] ioctl(4, LOOP_SET_FD, 3 [pid 5983] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5981] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5989] setpgid(0, 0 [pid 5983] <... futex resumed>) = 1 [pid 5983] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5979] <... futex resumed>) = 0 [pid 5989] <... setpgid resumed>) = 0 [pid 5989] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5980] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5979] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5983] <... futex resumed>) = 0 [pid 5980] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5979] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5989] <... openat resumed>) = 3 [pid 5988] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5983] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5980] <... futex resumed>) = 0 [pid 5988] ioctl(4, LOOP_CLR_FD) = 0 [pid 5989] write(3, "1000", 4 [pid 5980] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5983] <... openat resumed>) = 4 [pid 5988] ioctl(4, LOOP_SET_FD, 3 [pid 5980] <... mmap resumed>) = 0x7f47693ee000 [pid 5989] <... write resumed>) = 4 [pid 5983] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5989] close(3 [pid 5983] <... futex resumed>) = 1 [pid 5980] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5979] <... futex resumed>) = 0 [pid 5989] <... close resumed>) = 0 [pid 5988] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5979] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5989] symlink("/dev/binderfs", "./binderfs" [pid 5980] <... mprotect resumed>) = 0 [ 105.652923][ T5981] exFAT-fs (loop3): Filesystem has been set read-only executing program [pid 5989] <... symlink resumed>) = 0 [pid 5988] close(4 [pid 5983] mkdir("./file2", 0777 [pid 5981] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5980] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5979] <... futex resumed>) = 0 [pid 5989] write(1, "executing program\n", 18 [pid 5980] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5979] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5988] <... close resumed>) = 0 [pid 5988] close(3) = 0 [pid 5988] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5986] <... futex resumed>) = 0 [pid 5988] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5986] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5988] <... openat resumed>) = 3 [pid 5986] <... futex resumed>) = 0 [pid 5988] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5986] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5988] <... futex resumed>) = 0 [pid 5986] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5988] mkdir("./file2", 0777 [pid 5986] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5986] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5988] <... mkdir resumed>) = 0 [pid 5989] <... write resumed>) = 18 [pid 5988] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5987] <... ioctl resumed>) = 0 [pid 5989] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5986] <... futex resumed>) = ? [pid 5989] <... futex resumed>) = 0 [pid 5988] +++ killed by SIGSEGV +++ [pid 5987] close(3 [pid 5989] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5987] <... close resumed>) = 0 [pid 5981] +++ killed by SIGSEGV +++ [pid 5989] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5980] +++ killed by SIGSEGV +++ [pid 5989] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5987] close(4 [pid 5986] +++ killed by SIGSEGV +++ [pid 5989] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5987] <... close resumed>) = 0 [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5980, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5986, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5989] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5987] mkdir("./file1", 0777 [pid 5832] restart_syscall(<... resuming interrupted clone ...> [pid 5830] restart_syscall(<... resuming interrupted clone ...> [pid 5989] <... mmap resumed>) = 0x7f476940f000 [pid 5987] <... mkdir resumed>) = 0 [pid 5987] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5989] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5832] <... restart_syscall resumed>) = 0 [pid 5989] <... mprotect resumed>) = 0 [pid 5983] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5830] <... restart_syscall resumed>) = 0 [pid 5989] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5989] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5983] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5832] umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5989] <... clone3 resumed> => {parent_tid=[5990]}, 88) = 5990 [pid 5979] <... futex resumed>) = ? [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5990 attached [pid 5989] rt_sigprocmask(SIG_SETMASK, [], [pid 5983] +++ killed by SIGSEGV +++ [pid 5979] +++ killed by SIGSEGV +++ [pid 5832] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5990] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5989] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... openat resumed>) = 3 [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5979, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5990] <... rseq resumed>) = 0 [pid 5989] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 105.697992][ T5983] exFAT-fs (loop2): error, data size is invalid(9000) [ 105.733619][ T5983] exFAT-fs (loop2): Filesystem has been set read-only [pid 5832] newfstatat(3, "", [pid 5830] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5990] set_robust_list(0x7f476942f9a0, 24 [pid 5989] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5990] <... set_robust_list resumed>) = 0 [pid 5832] getdents64(3, [pid 5831] umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... openat resumed>) = 3 [pid 5990] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] newfstatat(3, "", [pid 5990] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5990] memfd_create("syzkaller", 0) = 3 [pid 5831] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] getdents64(3, [pid 5990] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5832] <... umount2 resumed>) = 0 [pid 5831] <... openat resumed>) = 3 [pid 5830] <... getdents64 resumed>0x555561217730 /* 5 entries */, 32768) = 144 [pid 5990] <... mmap resumed>) = 0x7f4761000000 [pid 5832] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] newfstatat(3, "", [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] umount2("./12/devices.list", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] newfstatat(AT_FDCWD, "./12/file1", [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5990] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] getdents64(3, [pid 5830] newfstatat(AT_FDCWD, "./12/devices.list", [pid 5990] <... write resumed>) = 131072 [pid 5832] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5990] munmap(0x7f4761000000, 138412032 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] unlink("./12/devices.list" [pid 5832] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5990] <... munmap resumed>) = 0 [pid 5832] <... openat resumed>) = 4 [pid 5831] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... unlink resumed>) = 0 [pid 5832] newfstatat(4, "", [pid 5830] umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5990] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5832] getdents64(4, [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] newfstatat(AT_FDCWD, "./12/binderfs", [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5990] <... openat resumed>) = 4 [pid 5832] getdents64(4, [pid 5830] unlink("./12/binderfs" [pid 5990] ioctl(4, LOOP_SET_FD, 3 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5832] close(4 [pid 5831] <... umount2 resumed>) = 0 [pid 5830] <... unlink resumed>) = 0 [pid 5831] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5831] newfstatat(AT_FDCWD, "./12/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] <... close resumed>) = 0 [pid 5831] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] umount2("./12/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] rmdir("./12/file1" [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5831] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] getdents64(4, [pid 5832] <... rmdir resumed>) = 0 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5832] umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5831] close(4) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] newfstatat(AT_FDCWD, "./12/file2", [pid 5831] rmdir("./12/file1") = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] newfstatat(AT_FDCWD, "./12/binderfs", [pid 5831] umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] umount2("./12/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] unlink("./12/binderfs" [pid 5831] newfstatat(AT_FDCWD, "./12/binderfs", [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] unlink("./12/binderfs" [pid 5832] <... unlink resumed>) = 0 [pid 5831] <... unlink resumed>) = 0 [pid 5830] openat(AT_FDCWD, "./12/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] close(3) = 0 [ 105.821984][ T5987] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 105.857517][ T5990] loop0: detected capacity change from 0 to 256 [pid 5831] rmdir("./12" [pid 5832] getdents64(3, [pid 5831] <... rmdir resumed>) = 0 [pid 5830] <... openat resumed>) = 4 [pid 5831] mkdir("./13", 0777 [pid 5830] newfstatat(4, "", [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] <... mkdir resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] close(3 [pid 5990] <... ioctl resumed>) = 0 [pid 5987] <... mount resumed>) = 0 [pid 5832] <... close resumed>) = 0 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5830] getdents64(4, [pid 5831] <... openat resumed>) = 3 [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5990] close(3 [pid 5832] rmdir("./12" [pid 5831] <... ioctl resumed>) = 0 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5987] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5831] close(3 [pid 5830] getdents64(4, [pid 5990] <... close resumed>) = 0 [pid 5987] <... openat resumed>) = 3 [pid 5832] <... rmdir resumed>) = 0 [pid 5831] <... close resumed>) = 0 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5990] close(4 [pid 5832] mkdir("./13", 0777 [pid 5830] close(4) = 0 [pid 5987] chdir("./file1") = 0 [pid 5987] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5990] <... close resumed>) = 0 [pid 5987] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5832] <... mkdir resumed>) = 0 [pid 5830] rmdir("./12/file2" [pid 5987] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5984] <... futex resumed>) = 0 [pid 5984] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5984] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5987] <... futex resumed>) = 1 [pid 5987] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5990] mkdir("./file1", 0777 [pid 5830] <... rmdir resumed>) = 0 [pid 5990] <... mkdir resumed>) = 0 [pid 5987] <... openat resumed>) = 4 [pid 5830] getdents64(3, [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] <... openat resumed>) = 3 [pid 5830] close(3 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5830] <... close resumed>) = 0 [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5830] rmdir("./12" [pid 5990] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5987] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... ioctl resumed>) = 0 [pid 5830] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 5991 attached [pid 5987] <... futex resumed>) = 1 [pid 5984] <... futex resumed>) = 0 [pid 5984] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] mkdir("./13", 0777 [pid 5991] set_robust_list(0x5555612166a0, 24 [pid 5984] <... futex resumed>) = 0 [pid 5832] close(3 [pid 5984] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] <... mkdir resumed>) = 0 [pid 5991] <... set_robust_list resumed>) = 0 [pid 5987] mkdir("./file2", 0777 [pid 5832] <... close resumed>) = 0 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5991] chdir("./13") = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 5991 [pid 5830] <... openat resumed>) = 3 ./strace-static-x86_64: Process 5992 attached [pid 5991] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5991] <... prctl resumed>) = 0 [pid 5992] set_robust_list(0x5555612166a0, 24 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 5992 [pid 5830] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 5992] <... set_robust_list resumed>) = 0 [pid 5991] setpgid(0, 0 [pid 5830] close(3 [pid 5991] <... setpgid resumed>) = 0 [pid 5992] chdir("./13" [pid 5991] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5830] <... close resumed>) = 0 [pid 5991] <... openat resumed>) = 3 [pid 5984] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5984] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5984] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5991] write(3, "1000", 4./strace-static-x86_64: Process 5993 attached ) = 4 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 5993 [pid 5991] close(3) = 0 [pid 5984] <... mmap resumed>) = 0x7f47693ee000 [pid 5991] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5992] <... chdir resumed>) = 0 [pid 5984] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5984] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5984] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5992] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5991] write(1, "executing program\n", 18executing program ) = 18 [pid 5984] <... clone3 resumed> => {parent_tid=[5994]}, 88) = 5994 [ 105.945419][ T5987] exFAT-fs (loop4): error, data size is invalid(9000) [ 105.969135][ T5987] exFAT-fs (loop4): Filesystem has been set read-only ./strace-static-x86_64: Process 5994 attached [pid 5993] set_robust_list(0x5555612166a0, 24 [pid 5992] <... prctl resumed>) = 0 [pid 5991] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5984] rt_sigprocmask(SIG_SETMASK, [], [pid 5993] <... set_robust_list resumed>) = 0 [pid 5992] setpgid(0, 0 [pid 5991] <... futex resumed>) = 0 [pid 5984] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5992] <... setpgid resumed>) = 0 [pid 5994] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5993] chdir("./13" [pid 5992] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5991] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5984] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5993] <... chdir resumed>) = 0 [pid 5994] <... rseq resumed>) = 0 [pid 5993] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5992] <... openat resumed>) = 3 [pid 5991] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5984] <... futex resumed>) = 0 [pid 5993] <... prctl resumed>) = 0 [pid 5994] set_robust_list(0x7f476940e9a0, 24 [pid 5993] setpgid(0, 0 [pid 5992] write(3, "1000", 4 [pid 5991] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5984] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5994] <... set_robust_list resumed>) = 0 [pid 5993] <... setpgid resumed>) = 0 [pid 5992] <... write resumed>) = 4 [pid 5991] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5992] close(3 [pid 5991] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5994] rt_sigprocmask(SIG_SETMASK, [], [pid 5991] <... mmap resumed>) = 0x7f476940f000 [pid 5992] <... close resumed>) = 0 [pid 5993] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5992] symlink("/dev/binderfs", "./binderfs" [pid 5987] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5991] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5992] <... symlink resumed>) = 0 [pid 5991] <... mprotect resumed>) = 0 [pid 5987] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5992] write(1, "executing program\n", 18 [pid 5991] rt_sigprocmask(SIG_BLOCK, ~[], executing program [pid 5992] <... write resumed>) = 18 [ 106.021171][ T5990] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5992] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5991] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5994] <... rt_sigprocmask resumed> ) = ? [pid 5984] <... futex resumed>) = ? [pid 5992] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5993] <... openat resumed>) = 3 [pid 5991] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5992] <... rt_sigaction resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 5995 attached [pid 5994] +++ killed by SIGSEGV +++ [pid 5992] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5995] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5992] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5991] <... clone3 resumed> => {parent_tid=[5995]}, 88) = 5995 [pid 5995] <... rseq resumed>) = 0 [pid 5992] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5991] rt_sigprocmask(SIG_SETMASK, [], [pid 5995] set_robust_list(0x7f476942f9a0, 24 [pid 5992] <... mmap resumed>) = 0x7f476940f000 [pid 5995] <... set_robust_list resumed>) = 0 [pid 5991] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5992] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5995] rt_sigprocmask(SIG_SETMASK, [], [pid 5991] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5992] <... mprotect resumed>) = 0 [pid 5995] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5991] <... futex resumed>) = 0 [pid 5995] memfd_create("syzkaller", 0 [pid 5993] write(3, "1000", 4 [pid 5992] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5991] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5987] +++ killed by SIGSEGV +++ [pid 5984] +++ killed by SIGSEGV +++ [pid 5995] <... memfd_create resumed>) = 3 [pid 5993] <... write resumed>) = 4 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5984, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5992] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5995] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5993] close(3) = 0 [pid 5833] umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5990] <... mount resumed>) = 0 [pid 5833] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5990] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5833] <... openat resumed>) = 3 [pid 5990] <... openat resumed>) = 3 [pid 5833] newfstatat(3, "", [pid 5990] chdir("./file1" [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5990] <... chdir resumed>) = 0 [pid 5833] getdents64(3, [pid 5990] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5990] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5833] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5990] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5989] <... futex resumed>) = 0 [pid 5990] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5989] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5995] <... mmap resumed>) = 0x7f4761000000 [pid 5993] symlink("/dev/binderfs", "./binderfs" [pid 5992] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5990] <... openat resumed>) = 4 [pid 5989] <... futex resumed>) = 0 [pid 5833] <... umount2 resumed>) = 0 [pid 5989] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./13/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5993] <... symlink resumed>) = 0 [pid 5833] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 5996 attached [pid 5995] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072executing program [pid 5992] <... clone3 resumed> => {parent_tid=[5996]}, 88) = 5996 [pid 5990] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5996] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5993] write(1, "executing program\n", 18 [pid 5990] <... futex resumed>) = 1 [pid 5989] <... futex resumed>) = 0 [pid 5833] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5996] <... rseq resumed>) = 0 [pid 5993] <... write resumed>) = 18 [pid 5992] rt_sigprocmask(SIG_SETMASK, [], [pid 5990] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5989] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... openat resumed>) = 4 [pid 5996] set_robust_list(0x7f476942f9a0, 24 [pid 5995] <... write resumed>) = 131072 [pid 5993] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5992] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5990] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5989] <... futex resumed>) = 0 [pid 5833] newfstatat(4, "", [pid 5996] <... set_robust_list resumed>) = 0 [pid 5995] munmap(0x7f4761000000, 138412032 [pid 5993] <... futex resumed>) = 0 [pid 5992] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5990] mkdir("./file2", 0777 [pid 5989] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5996] rt_sigprocmask(SIG_SETMASK, [], [pid 5995] <... munmap resumed>) = 0 [pid 5993] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5992] <... futex resumed>) = 0 [pid 5833] getdents64(4, [pid 5996] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5995] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5993] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5992] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5996] memfd_create("syzkaller", 0 [pid 5995] <... openat resumed>) = 4 [pid 5993] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5996] <... memfd_create resumed>) = 3 [pid 5995] ioctl(4, LOOP_SET_FD, 3 [pid 5993] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] getdents64(4, [pid 5996] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5996] <... mmap resumed>) = 0x7f4761000000 [pid 5996] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5833] close(4) = 0 [pid 5833] rmdir("./13/file1") = 0 [pid 5996] <... write resumed>) = 131072 [pid 5993] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5993] <... mmap resumed>) = 0x7f476940f000 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] unlink("./13/binderfs" [pid 5996] munmap(0x7f4761000000, 138412032 [pid 5833] <... unlink resumed>) = 0 [pid 5993] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5833] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5993] <... mprotect resumed>) = 0 [pid 5833] close(3) = 0 [ 106.157804][ T5990] exFAT-fs (loop0): error, data size is invalid(9000) [ 106.176983][ T5995] loop2: detected capacity change from 0 to 256 [pid 5993] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5996] <... munmap resumed>) = 0 [pid 5995] <... ioctl resumed>) = 0 [pid 5993] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5833] rmdir("./13" [pid 5995] close(3 [pid 5993] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 5997 attached [pid 5996] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5995] <... close resumed>) = 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5997] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5995] close(4 [pid 5993] <... clone3 resumed> => {parent_tid=[5997]}, 88) = 5997 [pid 5997] <... rseq resumed>) = 0 [pid 5995] <... close resumed>) = 0 [pid 5993] rt_sigprocmask(SIG_SETMASK, [], [pid 5997] set_robust_list(0x7f476942f9a0, 24 [pid 5995] mkdir("./file1", 0777 [pid 5993] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5997] <... set_robust_list resumed>) = 0 [pid 5993] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5997] rt_sigprocmask(SIG_SETMASK, [], [pid 5993] <... futex resumed>) = 0 [pid 5997] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5997] memfd_create("syzkaller", 0 [pid 5996] <... openat resumed>) = 4 [pid 5995] <... mkdir resumed>) = 0 [pid 5993] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5990] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5989] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5833] mkdir("./14", 0777 [pid 5997] <... memfd_create resumed>) = 3 [pid 5996] ioctl(4, LOOP_SET_FD, 3 [pid 5989] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5997] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5990] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5997] <... mmap resumed>) = 0x7f4761000000 [pid 5995] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5997] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 5989] <... futex resumed>) = ? [pid 5833] <... mkdir resumed>) = 0 [pid 5990] +++ killed by SIGSEGV +++ [pid 5997] munmap(0x7f4761000000, 138412032 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5997] <... munmap resumed>) = 0 [pid 5989] +++ killed by SIGSEGV +++ [pid 5833] <... openat resumed>) = 3 [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5989, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5833] <... ioctl resumed>) = 0 [pid 5829] restart_syscall(<... resuming interrupted clone ...> [pid 5833] close(3 [pid 5997] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5996] <... ioctl resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 5829] <... restart_syscall resumed>) = 0 [pid 5997] <... openat resumed>) = 4 [ 106.205054][ T5990] exFAT-fs (loop0): Filesystem has been set read-only [ 106.230320][ T5996] loop3: detected capacity change from 0 to 256 [pid 5996] close(3 [pid 5997] ioctl(4, LOOP_SET_FD, 3 [pid 5996] <... close resumed>) = 0 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5996] close(4) = 0 [pid 5996] mkdir("./file1", 0777) = 0 [pid 5829] umount2("./12", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5996] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 5998 attached [pid 5829] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5829] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] getdents64(3, [pid 5998] set_robust_list(0x5555612166a0, 24 [pid 5997] <... ioctl resumed>) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5998] <... set_robust_list resumed>) = 0 [pid 5829] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 5998 [pid 5997] close(3 [pid 5998] chdir("./14" [pid 5997] <... close resumed>) = 0 [pid 5998] <... chdir resumed>) = 0 [pid 5997] close(4) = 0 [pid 5997] mkdir("./file1", 0777 [pid 5998] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5997] <... mkdir resumed>) = 0 [pid 5829] <... umount2 resumed>) = 0 [pid 5997] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 5998] <... prctl resumed>) = 0 [pid 5829] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5998] setpgid(0, 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 106.277210][ T5997] loop1: detected capacity change from 0 to 256 [ 106.299082][ T5995] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5998] <... setpgid resumed>) = 0 [pid 5995] <... mount resumed>) = 0 [pid 5829] newfstatat(AT_FDCWD, "./12/file1", [pid 5998] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5995] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORYexecuting program [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5998] write(3, "1000", 4 [pid 5996] <... mount resumed>) = 0 [pid 5995] <... openat resumed>) = 3 [pid 5829] umount2("./12/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5998] <... write resumed>) = 4 [pid 5996] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5995] chdir("./file1" [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5998] close(3 [pid 5996] <... openat resumed>) = 3 [pid 5995] <... chdir resumed>) = 0 [pid 5829] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5998] <... close resumed>) = 0 [pid 5996] chdir("./file1" [pid 5995] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5829] <... openat resumed>) = 4 [pid 5998] symlink("/dev/binderfs", "./binderfs" [pid 5996] <... chdir resumed>) = 0 [pid 5995] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5829] newfstatat(4, "", [pid 5998] <... symlink resumed>) = 0 [pid 5996] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5995] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5998] write(1, "executing program\n", 18 [pid 5996] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5995] <... futex resumed>) = 1 [pid 5829] getdents64(4, [pid 5998] <... write resumed>) = 18 [pid 5995] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5998] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5996] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] getdents64(4, [pid 5998] <... futex resumed>) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5998] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5829] close(4 [pid 5998] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5996] <... futex resumed>) = 1 [pid 5829] <... close resumed>) = 0 [pid 5998] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5829] rmdir("./12/file1" [pid 5998] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5996] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5829] <... rmdir resumed>) = 0 [pid 5998] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5829] umount2("./12/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5998] <... mmap resumed>) = 0x7f476940f000 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5998] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5829] newfstatat(AT_FDCWD, "./12/binderfs", [pid 5998] <... mprotect resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5998] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5829] unlink("./12/binderfs" [pid 5998] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5829] <... unlink resumed>) = 0 [pid 5998] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5992] <... futex resumed>) = 0 [pid 5991] <... futex resumed>) = 0 [pid 5829] getdents64(3, ./strace-static-x86_64: Process 5999 attached [pid 5992] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5991] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5999] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5998] <... clone3 resumed> => {parent_tid=[5999]}, 88) = 5999 [pid 5996] <... futex resumed>) = 0 [pid 5995] <... futex resumed>) = 0 [pid 5992] <... futex resumed>) = 1 [pid 5991] <... futex resumed>) = 1 [pid 5829] close(3 [pid 5999] <... rseq resumed>) = 0 [pid 5998] rt_sigprocmask(SIG_SETMASK, [], [pid 5996] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5995] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5829] <... close resumed>) = 0 [pid 5999] set_robust_list(0x7f476942f9a0, 24 [pid 5998] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5829] rmdir("./12" [pid 5999] <... set_robust_list resumed>) = 0 [pid 5998] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... rmdir resumed>) = 0 [pid 5999] rt_sigprocmask(SIG_SETMASK, [], [pid 5998] <... futex resumed>) = 0 [pid 5829] mkdir("./13", 0777 [pid 5999] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5998] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5829] <... mkdir resumed>) = 0 [pid 5999] memfd_create("syzkaller", 0 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5999] <... memfd_create resumed>) = 3 [pid 5829] <... openat resumed>) = 3 [pid 5999] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5829] ioctl(3, LOOP_CLR_FD [pid 5999] <... mmap resumed>) = 0x7f4761000000 [pid 5991] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5829] <... ioctl resumed>) = 0 [pid 5992] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 106.378724][ T5996] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 106.403886][ T5997] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5829] close(3 [pid 5999] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5997] <... mount resumed>) = 0 [pid 5996] <... openat resumed>) = 4 [pid 5997] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5996] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5995] <... openat resumed>) = 4 [pid 5997] chdir("./file1") = 0 [pid 5997] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5996] <... futex resumed>) = 1 [pid 5995] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5992] <... futex resumed>) = 0 [pid 5999] <... write resumed>) = 131072 [pid 5997] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5996] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5995] <... futex resumed>) = 1 [pid 5992] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5991] <... futex resumed>) = 0 [pid 5999] munmap(0x7f4761000000, 138412032 [pid 5997] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5996] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5995] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5992] <... futex resumed>) = 0 [pid 5991] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... close resumed>) = 0 [pid 5999] <... munmap resumed>) = 0 [pid 5997] <... futex resumed>) = 1 [pid 5996] mkdir("./file2", 0777 [pid 5995] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5993] <... futex resumed>) = 0 [pid 5992] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5991] <... futex resumed>) = 0 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5997] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5995] mkdir("./file2", 0777 [pid 5993] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5991] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5999] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5997] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5993] <... futex resumed>) = 0 [pid 5999] <... openat resumed>) = 4 [pid 5997] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5993] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5997] <... openat resumed>) = 4 [pid 5999] ioctl(4, LOOP_SET_FD, 3 [pid 5997] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 5997] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5993] <... futex resumed>) = 0 [pid 5993] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5997] <... futex resumed>) = 0 [pid 5993] <... futex resumed>) = 1 [pid 5997] mkdir("./file2", 0777 [pid 5993] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5999] <... ioctl resumed>) = 0 [pid 5999] close(3) = 0 [pid 5999] close(4) = 0 [pid 5999] mkdir("./file1", 0777) = 0 [pid 5999] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5992] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5992] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5992] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 5992] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5991] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5992] <... mprotect resumed>) = 0 [pid 5991] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5992] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5991] <... futex resumed>) = 0 [ 106.479498][ T5996] exFAT-fs (loop3): error, data size is invalid(9000) [ 106.487721][ T5999] loop4: detected capacity change from 0 to 256 [ 106.488857][ T5995] exFAT-fs (loop2): error, data size is invalid(9000) [ 106.499007][ T5997] exFAT-fs (loop1): error, data size is invalid(9000) [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 6000 [pid 5992] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5991] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5992] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5991] <... mmap resumed>) = 0x7f47693ee000 ./strace-static-x86_64: Process 6000 attached [pid 5993] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5993] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5991] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5993] <... futex resumed>) = 0 [pid 5992] <... clone3 resumed> => {parent_tid=[6001]}, 88) = 6001 [pid 5991] <... mprotect resumed>) = 0 [pid 5993] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5992] rt_sigprocmask(SIG_SETMASK, [], [pid 5991] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5993] <... mmap resumed>) = 0x7f47693ee000 [pid 5992] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5991] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5993] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5992] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [ 106.549005][ T5999] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 106.552991][ T5996] exFAT-fs (loop3): Filesystem has been set read-only [ 106.588322][ T5995] exFAT-fs (loop2): Filesystem has been set read-only [pid 5991] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 6000] set_robust_list(0x5555612166a0, 24 [pid 5993] <... mprotect resumed>) = 0 [pid 5992] <... futex resumed>) = 0 [pid 6000] <... set_robust_list resumed>) = 0 [pid 5993] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5992] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5991] <... clone3 resumed> => {parent_tid=[6002]}, 88) = 6002 ./strace-static-x86_64: Process 6002 attached ./strace-static-x86_64: Process 6001 attached [pid 6000] chdir("./13" [pid 5993] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5991] rt_sigprocmask(SIG_SETMASK, [], [pid 6001] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 5993] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5991] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6001] <... rseq resumed>) = 0 [pid 5991] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6001] set_robust_list(0x7f476940e9a0, 24 [pid 5993] <... clone3 resumed> => {parent_tid=[6003]}, 88) = 6003 [pid 5991] <... futex resumed>) = 0 [pid 6001] <... set_robust_list resumed>) = 0 [pid 5993] rt_sigprocmask(SIG_SETMASK, [], [pid 5991] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6001] rt_sigprocmask(SIG_SETMASK, [], [pid 5993] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 6003 attached [pid 6001] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5993] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6003] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6001] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5993] <... futex resumed>) = 0 [pid 6003] <... rseq resumed>) = 0 [pid 6002] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6001] <... ioctl resumed>) = 0 [pid 6000] <... chdir resumed>) = 0 [pid 5993] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6002] <... rseq resumed>) = 0 [pid 6000] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6003] set_robust_list(0x7f476940e9a0, 24 [pid 6002] set_robust_list(0x7f476940e9a0, 24 [pid 6001] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6000] <... prctl resumed>) = 0 [pid 6003] <... set_robust_list resumed>) = 0 [pid 6002] <... set_robust_list resumed>) = 0 [pid 6001] <... futex resumed>) = 1 [pid 5992] <... futex resumed>) = 0 [pid 6003] rt_sigprocmask(SIG_SETMASK, [], [pid 6002] rt_sigprocmask(SIG_SETMASK, [], [pid 6001] futex(0x7f47695046d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6000] setpgid(0, 0 [pid 6003] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6002] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6000] <... setpgid resumed>) = 0 [pid 6003] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 6002] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 6000] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6003] <... ioctl resumed>) = 0 [pid 6002] <... ioctl resumed>) = 0 [pid 6000] <... openat resumed>) = 3 [pid 6003] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6002] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6000] write(3, "1000", 4 [pid 5999] <... mount resumed>) = 0 [pid 5995] <... mkdir resumed>) = -1 EIO (Input/output error) [ 106.599976][ T5997] exFAT-fs (loop1): Filesystem has been set read-only [pid 5993] <... futex resumed>) = 0 [pid 6003] futex(0x7f47695046d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6002] <... futex resumed>) = 1 [pid 6000] <... write resumed>) = 4 [pid 5999] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5997] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5995] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5991] <... futex resumed>) = 230 [pid 6000] close(3 [pid 5999] <... openat resumed>) = 3 [pid 5997] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6002] +++ killed by SIGSEGV +++ [pid 6000] <... close resumed>) = 0 [pid 5999] chdir("./file1") = 0 [pid 5999] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 6003] <... futex resumed>) = ? [pid 5999] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5997] +++ killed by SIGSEGV +++ [pid 5995] +++ killed by SIGSEGV +++ [pid 5991] +++ killed by SIGSEGV +++ [pid 6000] symlink("/dev/binderfs", "./binderfs" [pid 5999] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5991, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5831] restart_syscall(<... resuming interrupted clone ...>executing program [pid 6000] <... symlink resumed>) = 0 [pid 6000] write(1, "executing program\n", 18 [pid 5999] <... futex resumed>) = 1 [pid 5998] <... futex resumed>) = 0 [pid 5831] <... restart_syscall resumed>) = 0 [pid 6003] +++ killed by SIGSEGV +++ [pid 6000] <... write resumed>) = 18 [pid 5999] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5998] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5993] +++ killed by SIGSEGV +++ [pid 6000] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5999] <... openat resumed>) = 4 [pid 5998] <... futex resumed>) = 0 [pid 5996] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6000] <... futex resumed>) = 0 [pid 6000] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5998] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5996] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5993, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 6000] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5999] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6001] <... futex resumed>) = ? [pid 6000] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5999] <... futex resumed>) = 1 [pid 5998] <... futex resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6001] +++ killed by SIGSEGV +++ [pid 6000] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5999] mkdir("./file2", 0777 [pid 5998] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5996] +++ killed by SIGSEGV +++ [pid 5992] +++ killed by SIGSEGV +++ [pid 5831] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6000] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5998] <... futex resumed>) = 0 [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5992, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 6000] <... mmap resumed>) = 0x7f476940f000 [pid 5998] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] restart_syscall(<... resuming interrupted clone ...> [pid 5831] <... openat resumed>) = 3 [pid 5830] umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6000] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5832] <... restart_syscall resumed>) = 0 [pid 5831] newfstatat(3, "", [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6000] <... mprotect resumed>) = 0 [pid 6000] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6000] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5831] getdents64(3, [pid 5830] <... openat resumed>) = 3 [pid 6000] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5832] umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] newfstatat(3, "", ./strace-static-x86_64: Process 6004 attached [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6004] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6000] <... clone3 resumed> => {parent_tid=[6004]}, 88) = 6004 [pid 5832] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] <... umount2 resumed>) = 0 [pid 5830] getdents64(3, [pid 6004] <... rseq resumed>) = 0 [pid 6000] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... openat resumed>) = 3 [pid 5831] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6000] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6004] set_robust_list(0x7f476942f9a0, 24 [pid 6000] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6004] <... set_robust_list resumed>) = 0 [pid 6000] <... futex resumed>) = 0 [pid 6004] rt_sigprocmask(SIG_SETMASK, [], [pid 6000] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6004] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] newfstatat(3, "", [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6004] memfd_create("syzkaller", 0 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] newfstatat(AT_FDCWD, "./13/file1", [pid 5832] getdents64(3, [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] <... umount2 resumed>) = 0 [pid 6004] <... memfd_create resumed>) = 3 [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [ 106.719052][ T5999] exFAT-fs (loop4): error, data size is invalid(9000) [pid 5831] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6004] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5998] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5832] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6004] <... mmap resumed>) = 0x7f4761000000 [pid 5998] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5831] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5998] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5831] <... openat resumed>) = 4 [pid 5998] <... mmap resumed>) = 0x7f47693ee000 [pid 5998] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 6004] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5998] <... mprotect resumed>) = 0 [pid 5831] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] newfstatat(AT_FDCWD, "./13/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5998] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5830] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5998] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5831] getdents64(4, [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5998] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] getdents64(4, [pid 5830] <... openat resumed>) = 4 [pid 5998] <... clone3 resumed> => {parent_tid=[6005]}, 88) = 6005 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] newfstatat(4, "", [pid 5998] rt_sigprocmask(SIG_SETMASK, [], [pid 5831] close(4 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 6005 attached [pid 5998] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] <... close resumed>) = 0 [pid 5830] getdents64(4, [pid 5998] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] rmdir("./13/file1" [pid 6004] <... write resumed>) = 131072 [pid 5998] <... futex resumed>) = 0 [pid 5831] <... rmdir resumed>) = 0 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5998] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] getdents64(4, [pid 6005] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6004] munmap(0x7f4761000000, 138412032 [pid 5832] <... umount2 resumed>) = 0 [pid 5831] umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6005] <... rseq resumed>) = 0 [pid 5832] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] close(4 [pid 6005] set_robust_list(0x7f476940e9a0, 24 [pid 6004] <... munmap resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] newfstatat(AT_FDCWD, "./13/binderfs", [pid 5830] <... close resumed>) = 0 [pid 6005] <... set_robust_list resumed>) = 0 [pid 6004] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5832] newfstatat(AT_FDCWD, "./13/file1", [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] rmdir("./13/file1" [ 106.772920][ T5999] exFAT-fs (loop4): Filesystem has been set read-only [pid 6005] rt_sigprocmask(SIG_SETMASK, [], [pid 6004] <... openat resumed>) = 4 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] unlink("./13/binderfs" [pid 5830] <... rmdir resumed>) = 0 [pid 6005] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6004] ioctl(4, LOOP_SET_FD, 3 [pid 6005] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5999] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5832] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... unlink resumed>) = 0 [pid 5830] umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5999] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] getdents64(3, [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5830] newfstatat(AT_FDCWD, "./13/binderfs", [pid 5832] <... openat resumed>) = 4 [pid 5831] close(3 [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] newfstatat(4, "", [pid 5831] <... close resumed>) = 0 [pid 5830] unlink("./13/binderfs" [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] rmdir("./13" [pid 5830] <... unlink resumed>) = 0 [pid 5832] getdents64(4, [pid 5830] getdents64(3, [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] getdents64(4, [pid 5831] <... rmdir resumed>) = 0 [pid 5830] close(3 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] <... close resumed>) = 0 [pid 5832] close(4 [pid 5830] rmdir("./13" [pid 5998] <... futex resumed>) = ? [pid 5832] <... close resumed>) = 0 [pid 5830] <... rmdir resumed>) = 0 [pid 5999] +++ killed by SIGSEGV +++ [pid 5832] rmdir("./13/file1" [pid 5831] mkdir("./14", 0777 [pid 5830] mkdir("./14", 0777 [pid 5832] <... rmdir resumed>) = 0 [pid 5831] <... mkdir resumed>) = 0 [pid 5830] <... mkdir resumed>) = 0 [pid 5832] umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./13/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] unlink("./13/binderfs") = 0 [pid 5832] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6005] <... ioctl resumed>) = ? [pid 5832] close(3) = 0 [pid 5831] <... openat resumed>) = 3 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5832] rmdir("./13" [pid 5830] <... ioctl resumed>) = 0 [pid 5832] <... rmdir resumed>) = 0 [pid 5831] ioctl(3, LOOP_CLR_FD [pid 5830] close(3 [pid 5832] mkdir("./14", 0777 [pid 5831] <... ioctl resumed>) = 0 [pid 5832] <... mkdir resumed>) = 0 [pid 5831] close(3 [pid 5830] <... close resumed>) = 0 [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6005] +++ killed by SIGSEGV +++ [pid 5998] +++ killed by SIGSEGV +++ [pid 6004] <... ioctl resumed>) = 0 [pid 6004] close(3 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5998, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 6004] <... close resumed>) = 0 [pid 5833] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 6006 attached [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 6006 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [ 106.817954][ T6004] loop0: detected capacity change from 0 to 256 [pid 5832] ioctl(3, LOOP_CLR_FD [pid 6006] set_robust_list(0x5555612166a0, 24 [pid 6004] close(4 [pid 5833] <... restart_syscall resumed>) = 0 [pid 5831] <... close resumed>) = 0 [pid 5832] <... ioctl resumed>) = 0 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6006] <... set_robust_list resumed>) = 0 [pid 6004] <... close resumed>) = 0 [pid 5832] close(3 [pid 6006] chdir("./14" [pid 6004] mkdir("./file1", 0777 [pid 5832] <... close resumed>) = 0 [pid 5833] umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 6007 attached [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 6007 [pid 6004] <... mkdir resumed>) = 0 [pid 6007] set_robust_list(0x5555612166a0, 24 [pid 6006] <... chdir resumed>) = 0 [pid 6004] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6007] <... set_robust_list resumed>) = 0 [pid 6007] chdir("./14") = 0 [pid 6007] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6007] setpgid(0, 0) = 0 [pid 6007] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5833] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6006] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6007] <... openat resumed>) = 3 [pid 6007] write(3, "1000", 4 [pid 6006] <... prctl resumed>) = 0 [pid 5833] <... openat resumed>) = 3 [pid 6006] setpgid(0, 0 [pid 5833] newfstatat(3, "", [pid 6006] <... setpgid resumed>) = 0 [pid 6007] <... write resumed>) = 4 [pid 6007] close(3 [pid 6006] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6007] <... close resumed>) = 0 [pid 6007] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6006] <... openat resumed>) = 3 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] getdents64(3, [pid 6006] write(3, "1000", 4 [pid 6007] write(1, "executing program\n", 18executing program ) = 18 [pid 6007] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6007] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6006] <... write resumed>) = 4 [pid 6006] close(3 [pid 5833] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6007] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6006] <... close resumed>) = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6007] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6006] symlink("/dev/binderfs", "./binderfs" [pid 6007] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6007] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 6007] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6006] <... symlink resumed>) = 0 ./strace-static-x86_64: Process 6008 attached [pid 6007] rt_sigprocmask(SIG_BLOCK, ~[], executing program [pid 6006] write(1, "executing program\n", 18 [pid 6008] set_robust_list(0x5555612166a0, 24 [pid 6007] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6007] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}executing program ./strace-static-x86_64: Process 6009 attached [pid 6006] <... write resumed>) = 18 [pid 6009] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6008] <... set_robust_list resumed>) = 0 [pid 6009] <... rseq resumed>) = 0 [pid 6008] chdir("./14" [pid 6006] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6009] set_robust_list(0x7f476942f9a0, 24 [pid 6008] <... chdir resumed>) = 0 [pid 6006] <... futex resumed>) = 0 [pid 6009] <... set_robust_list resumed>) = 0 [pid 6008] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6006] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6009] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 6008 [pid 6009] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6009] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6008] <... prctl resumed>) = 0 [pid 6007] <... clone3 resumed> => {parent_tid=[6009]}, 88) = 6009 [pid 6008] setpgid(0, 0 [pid 6007] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6008] <... setpgid resumed>) = 0 [pid 6007] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6009] <... futex resumed>) = 0 [pid 6008] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6007] <... futex resumed>) = 1 [pid 6009] memfd_create("syzkaller", 0 [pid 6008] <... openat resumed>) = 3 [pid 6007] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6006] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6006] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6009] <... memfd_create resumed>) = 3 [pid 6008] write(3, "1000", 4 [pid 6006] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6009] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6008] <... write resumed>) = 4 [pid 6006] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6009] <... mmap resumed>) = 0x7f4761000000 [pid 6008] close(3 [pid 6006] <... mmap resumed>) = 0x7f476940f000 [pid 6009] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6008] <... close resumed>) = 0 [pid 6006] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6009] <... write resumed>) = 131072 [pid 6008] symlink("/dev/binderfs", "./binderfs" [pid 6006] <... mprotect resumed>) = 0 [pid 6008] <... symlink resumed>) = 0 [pid 6008] write(1, "executing program\n", 18) = 18 [pid 6008] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6008] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 6009] munmap(0x7f4761000000, 138412032 [pid 6006] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6009] <... munmap resumed>) = 0 [pid 6008] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6009] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6008] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6009] <... openat resumed>) = 4 [pid 6008] <... mmap resumed>) = 0x7f476940f000 [pid 6008] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6009] ioctl(4, LOOP_SET_FD, 3 [pid 6006] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5833] <... umount2 resumed>) = 0 [pid 6008] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6006] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5833] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6008] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6008] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 6010 attached [pid 6006] <... clone3 resumed> => {parent_tid=[6010]}, 88) = 6010 [pid 6008] <... clone3 resumed> => {parent_tid=[6011]}, 88) = 6011 [pid 6008] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6008] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 6011 attached [pid 6010] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6008] <... futex resumed>) = 0 [pid 6006] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] newfstatat(AT_FDCWD, "./14/file1", [pid 6006] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6008] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6010] <... rseq resumed>) = 0 [pid 6006] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6010] set_robust_list(0x7f476942f9a0, 24 [pid 6006] <... futex resumed>) = 0 [pid 6011] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6010] <... set_robust_list resumed>) = 0 [pid 5833] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6011] <... rseq resumed>) = 0 [pid 6011] set_robust_list(0x7f476942f9a0, 24 [pid 6010] rt_sigprocmask(SIG_SETMASK, [], [pid 6009] <... ioctl resumed>) = 0 [pid 6006] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6010] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6011] <... set_robust_list resumed>) = 0 [pid 6011] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6011] memfd_create("syzkaller", 0 [pid 6010] memfd_create("syzkaller", 0 [pid 5833] <... openat resumed>) = 4 [pid 6011] <... memfd_create resumed>) = 3 [pid 6011] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 6010] <... memfd_create resumed>) = 3 [pid 5833] newfstatat(4, "", [pid 6009] close(3 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6009] <... close resumed>) = 0 [pid 5833] getdents64(4, [pid 6009] close(4) = 0 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6010] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6009] mkdir("./file1", 0777 [pid 5833] getdents64(4, [pid 6009] <... mkdir resumed>) = 0 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [ 106.949914][ T6004] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 106.964888][ T6009] loop2: detected capacity change from 0 to 256 [pid 6009] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 5833] close(4 [pid 6010] <... mmap resumed>) = 0x7f4761000000 [pid 5833] <... close resumed>) = 0 [pid 6010] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5833] rmdir("./14/file1" [pid 6011] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5833] <... rmdir resumed>) = 0 [pid 5833] umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6010] <... write resumed>) = 131072 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6004] <... mount resumed>) = 0 [pid 6004] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 6004] chdir("./file1") = 0 [pid 6004] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 6011] <... write resumed>) = 131072 [pid 6010] munmap(0x7f4761000000, 138412032 [pid 6009] <... mount resumed>) = 0 [pid 5833] newfstatat(AT_FDCWD, "./14/binderfs", [pid 6011] munmap(0x7f4761000000, 138412032 [pid 6004] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6009] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6011] <... munmap resumed>) = 0 [pid 6010] <... munmap resumed>) = 0 [pid 6004] <... futex resumed>) = 1 [pid 6011] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6004] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6011] <... openat resumed>) = 4 [pid 6011] ioctl(4, LOOP_SET_FD, 3 [pid 6010] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 6009] <... openat resumed>) = 3 [ 107.018830][ T6009] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6010] <... openat resumed>) = 4 [pid 6009] chdir("./file1" [pid 6000] <... futex resumed>) = 0 [pid 5833] unlink("./14/binderfs" [pid 6010] ioctl(4, LOOP_SET_FD, 3 [pid 6011] <... ioctl resumed>) = 0 [pid 6010] <... ioctl resumed>) = 0 [pid 6009] <... chdir resumed>) = 0 [pid 6000] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... unlink resumed>) = 0 [pid 6010] close(3 [pid 6009] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6004] <... futex resumed>) = 0 [pid 6000] <... futex resumed>) = 1 [pid 5833] getdents64(3, [pid 6011] close(3 [pid 6010] <... close resumed>) = 0 [pid 6004] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6009] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6010] close(4 [pid 6009] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6004] <... openat resumed>) = 4 [pid 6000] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6010] <... close resumed>) = 0 [pid 6009] <... futex resumed>) = 1 [pid 6007] <... futex resumed>) = 0 [pid 6004] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6000] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5833] close(3 [pid 6011] <... close resumed>) = 0 [pid 6010] mkdir("./file1", 0777 [pid 6009] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6007] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6004] <... futex resumed>) = 0 [pid 6011] close(4 [pid 6007] <... futex resumed>) = 0 [pid 6004] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5833] <... close resumed>) = 0 [pid 6011] <... close resumed>) = 0 [ 107.079948][ T6011] loop3: detected capacity change from 0 to 256 [ 107.095974][ T6010] loop1: detected capacity change from 0 to 256 [pid 6007] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6011] mkdir("./file1", 0777 [pid 6010] <... mkdir resumed>) = 0 [pid 6009] <... openat resumed>) = 4 [pid 6000] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] rmdir("./14" [pid 6009] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6007] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6000] <... futex resumed>) = 1 [pid 6011] <... mkdir resumed>) = 0 [pid 6010] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 6009] <... futex resumed>) = 0 [pid 6007] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6004] <... futex resumed>) = 0 [pid 6000] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... rmdir resumed>) = 0 [pid 6011] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 6009] mkdir("./file2", 0777 [pid 6007] <... futex resumed>) = 0 [pid 6004] mkdir("./file2", 0777 [pid 5833] mkdir("./15", 0777 [pid 6007] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... mkdir resumed>) = 0 [pid 6007] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [ 107.166173][ T6004] exFAT-fs (loop0): error, data size is invalid(9000) [ 107.175478][ T6009] exFAT-fs (loop2): error, data size is invalid(9000) [ 107.199799][ T6010] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6007] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 6007] <... futex resumed>) = 0 [pid 6007] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 6007] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6007] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6007] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0}./strace-static-x86_64: Process 6012 attached => {parent_tid=[6012]}, 88) = 6012 [pid 6007] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] <... openat resumed>) = 3 [pid 6000] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 6007] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6007] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6007] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6000] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] ioctl(3, LOOP_CLR_FD [ 107.217749][ T6004] exFAT-fs (loop0): Filesystem has been set read-only [ 107.233841][ T6009] exFAT-fs (loop2): Filesystem has been set read-only [pid 6012] rseq(0x7f476940efe0, 0x20, 0, 0x53053053) = 0 [pid 5833] <... ioctl resumed>) = 0 [pid 6012] set_robust_list(0x7f476940e9a0, 24 [pid 6010] <... mount resumed>) = 0 [pid 6009] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6004] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6000] <... futex resumed>) = 0 [pid 5833] close(3 [pid 6012] <... set_robust_list resumed>) = 0 [pid 6000] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6012] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6012] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080) = 0 [pid 6012] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6010] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6009] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6007] <... futex resumed>) = 0 [pid 6004] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6000] <... mmap resumed>) = 0x7f47693ee000 [pid 5833] <... close resumed>) = 0 [pid 6000] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6000] <... mprotect resumed>) = 0 [pid 6012] futex(0x7f47695046d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 6013 attached [pid 6000] ???( [pid 6013] set_robust_list(0x5555612166a0, 24 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 6013 [pid 6000] <... ??? resumed>) = ? [pid 6013] <... set_robust_list resumed>) = 0 [pid 6013] chdir("./15") = 0 [pid 6013] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6010] <... openat resumed>) = 3 [pid 6013] setpgid(0, 0 [pid 6010] chdir("./file1" [pid 6013] <... setpgid resumed>) = 0 [pid 6013] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6010] <... chdir resumed>) = 0 [pid 6010] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 6013] <... openat resumed>) = 3 [pid 6010] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6013] write(3, "1000", 4 [pid 6010] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6013] <... write resumed>) = 4 [pid 6010] <... futex resumed>) = 1 [pid 6006] <... futex resumed>) = 0 [pid 6013] close(3 [pid 6010] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6006] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6013] <... close resumed>) = 0 [pid 6006] <... futex resumed>) = 0 [pid 6013] symlink("/dev/binderfs", "./binderfs" [pid 6010] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6006] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6013] <... symlink resumed>) = 0 [pid 6012] <... futex resumed>) = ? [pid 6010] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6004] +++ killed by SIGSEGV +++ [pid 6000] +++ killed by SIGSEGV +++ executing program [pid 6013] write(1, "executing program\n", 18 [pid 6012] +++ killed by SIGSEGV +++ [pid 6011] <... mount resumed>) = 0 [pid 6010] <... openat resumed>) = 4 [pid 6009] +++ killed by SIGSEGV +++ [pid 6007] +++ killed by SIGSEGV +++ [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6000, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 6013] <... write resumed>) = 18 [pid 6011] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6010] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6007, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [ 107.255775][ T6011] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5829] restart_syscall(<... resuming interrupted clone ...> [pid 6013] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6011] <... openat resumed>) = 3 [pid 6010] <... futex resumed>) = 1 [pid 6006] <... futex resumed>) = 0 [pid 5831] restart_syscall(<... resuming interrupted clone ...> [pid 6013] <... futex resumed>) = 0 [pid 6006] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... restart_syscall resumed>) = 0 [pid 6006] <... futex resumed>) = 0 [pid 6013] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6006] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6013] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6013] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6010] mkdir("./file2", 0777 [pid 6013] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] <... restart_syscall resumed>) = 0 [pid 6011] chdir("./file1" [pid 5831] umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6013] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6011] <... chdir resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] umount2("./13", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6013] <... mmap resumed>) = 0x7f476940f000 [pid 6011] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6013] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6011] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5831] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6013] <... mprotect resumed>) = 0 [pid 6011] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... openat resumed>) = 3 [pid 6011] <... futex resumed>) = 1 [pid 6008] <... futex resumed>) = 0 [pid 5829] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6011] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6008] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] newfstatat(3, "", [pid 6013] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6008] <... futex resumed>) = 0 [pid 5829] <... openat resumed>) = 3 [pid 6013] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6011] <... openat resumed>) = 4 [pid 6008] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] newfstatat(3, "", [pid 6011] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] getdents64(3, [pid 6013] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6011] <... futex resumed>) = 1 [pid 6008] <... futex resumed>) = 0 [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6008] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 6014 attached [pid 6008] <... futex resumed>) = 0 [pid 5831] <... umount2 resumed>) = 0 [pid 5829] getdents64(3, [pid 6014] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6013] <... clone3 resumed> => {parent_tid=[6014]}, 88) = 6014 [pid 6011] mkdir("./file2", 0777 [pid 6008] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6014] <... rseq resumed>) = 0 [pid 6013] rt_sigprocmask(SIG_SETMASK, [], [pid 5831] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6013] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] newfstatat(AT_FDCWD, "./14/file1", [pid 6013] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 107.313541][ T6010] exFAT-fs (loop1): error, data size is invalid(9000) [ 107.347012][ T6011] exFAT-fs (loop3): error, data size is invalid(9000) [pid 6013] <... futex resumed>) = 0 [pid 6006] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5831] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6006] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6006] <... futex resumed>) = 0 [pid 5831] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6006] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5831] <... openat resumed>) = 4 [pid 6013] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6006] <... mmap resumed>) = 0x7f47693ee000 [pid 5831] newfstatat(4, "", [pid 6006] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6006] <... mprotect resumed>) = 0 [pid 5831] getdents64(4, [pid 6014] set_robust_list(0x7f476942f9a0, 24 [pid 6006] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6006] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5831] getdents64(4, [pid 6014] <... set_robust_list resumed>) = 0 [pid 6006] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6014] rt_sigprocmask(SIG_SETMASK, [], [pid 5831] close(4 [pid 6006] <... clone3 resumed> => {parent_tid=[6015]}, 88) = 6015 [pid 5831] <... close resumed>) = 0 [pid 6006] rt_sigprocmask(SIG_SETMASK, [], [pid 5831] rmdir("./14/file1" [pid 6014] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6006] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] <... rmdir resumed>) = 0 [pid 6006] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6006] <... futex resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6006] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] newfstatat(AT_FDCWD, "./14/binderfs", [pid 6014] memfd_create("syzkaller", 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] unlink("./14/binderfs" [pid 6014] <... memfd_create resumed>) = 3 [pid 5831] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 6015 attached [pid 6015] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6014] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6015] <... rseq resumed>) = 0 [pid 6015] set_robust_list(0x7f476940e9a0, 24) = 0 [pid 6015] rt_sigprocmask(SIG_SETMASK, [], [pid 6014] <... mmap resumed>) = 0x7f4761000000 [pid 6008] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 6015] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6008] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6015] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 6008] <... futex resumed>) = 0 [pid 6015] <... ioctl resumed>) = 0 [pid 6008] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6015] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6008] <... mmap resumed>) = 0x7f47693ee000 [pid 6015] <... futex resumed>) = 1 [pid 6008] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 6006] <... futex resumed>) = 0 [pid 6015] futex(0x7f47695046d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6008] <... mprotect resumed>) = 0 [pid 6008] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5831] getdents64(3, [pid 6010] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6008] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6014] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6008] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0}./strace-static-x86_64: Process 6016 attached [pid 5831] close(3 [pid 6016] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6008] <... clone3 resumed> => {parent_tid=[6016]}, 88) = 6016 [pid 5831] <... close resumed>) = 0 [pid 6016] <... rseq resumed>) = 0 [pid 6014] <... write resumed>) = 131072 [pid 6010] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6008] rt_sigprocmask(SIG_SETMASK, [], [pid 5831] rmdir("./14" [pid 6016] set_robust_list(0x7f476940e9a0, 24 [pid 6015] <... futex resumed>) = ? [pid 6014] munmap(0x7f4761000000, 138412032 [pid 6008] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] <... rmdir resumed>) = 0 [pid 6016] <... set_robust_list resumed>) = 0 [pid 6015] +++ killed by SIGSEGV +++ [pid 6011] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6008] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6016] rt_sigprocmask(SIG_SETMASK, [], [pid 6014] <... munmap resumed>) = 0 [pid 6008] <... futex resumed>) = 0 [pid 6016] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6011] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6008] read(0, [pid 5831] mkdir("./15", 0777 [pid 6014] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5831] <... mkdir resumed>) = 0 [pid 5829] <... umount2 resumed>) = 0 [ 107.360344][ T6010] exFAT-fs (loop1): Filesystem has been set read-only [ 107.391450][ T6011] exFAT-fs (loop3): Filesystem has been set read-only [pid 6016] +++ killed by SIGSEGV +++ [pid 6014] <... openat resumed>) = 4 [pid 6011] +++ killed by SIGSEGV +++ [pid 6008] +++ killed by SIGSEGV +++ [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6014] ioctl(4, LOOP_SET_FD, 3 [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6008, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5832] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5832] umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5832] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5832] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 5832] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... openat resumed>) = 3 [pid 5831] ioctl(3, LOOP_CLR_FD) = 0 [pid 5831] close(3) = 0 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6017 attached [pid 6017] set_robust_list(0x5555612166a0, 24) = 0 [pid 6017] chdir("./15" [pid 5832] <... umount2 resumed>) = 0 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 6017 [pid 5829] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6010] +++ killed by SIGSEGV +++ [pid 6006] +++ killed by SIGSEGV +++ [pid 5832] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6006, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5832] newfstatat(AT_FDCWD, "./14/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6017] <... chdir resumed>) = 0 [pid 5832] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6017] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6017] <... prctl resumed>) = 0 [pid 5832] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6017] setpgid(0, 0 [pid 5832] <... openat resumed>) = 4 [pid 6017] <... setpgid resumed>) = 0 [pid 5832] newfstatat(4, "", [pid 6017] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6017] <... openat resumed>) = 3 [pid 5832] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6017] write(3, "1000", 4 [pid 5832] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5832] close(4) = 0 [pid 6017] <... write resumed>) = 4 [pid 6014] <... ioctl resumed>) = 0 [pid 5832] rmdir("./14/file1" [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6017] close(3 [pid 6014] close(3 [pid 5832] <... rmdir resumed>) = 0 [ 107.452720][ T6014] loop4: detected capacity change from 0 to 256 [pid 6017] <... close resumed>) = 0 [pid 6014] <... close resumed>) = 0 [pid 5832] umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] newfstatat(AT_FDCWD, "./13/file1", [pid 6017] symlink("/dev/binderfs", "./binderfs" [pid 6014] close(4 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6017] <... symlink resumed>) = 0 [pid 6014] <... close resumed>) = 0 [pid 5832] newfstatat(AT_FDCWD, "./14/binderfs", [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 executing program [pid 6017] write(1, "executing program\n", 18 [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6017] <... write resumed>) = 18 [pid 5832] unlink("./14/binderfs" [pid 6017] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6014] mkdir("./file1", 0777 [pid 5832] <... unlink resumed>) = 0 [pid 5830] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] umount2("./13/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6017] <... futex resumed>) = 0 [pid 5832] getdents64(3, [pid 5830] <... openat resumed>) = 3 [pid 6017] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6014] <... mkdir resumed>) = 0 [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6017] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6014] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5830] newfstatat(3, "", [pid 6017] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5832] close(3 [pid 5829] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6017] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... close resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6017] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5830] getdents64(3, [pid 5829] <... openat resumed>) = 4 [pid 6017] <... mmap resumed>) = 0x7f476940f000 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5829] newfstatat(4, "", [pid 6017] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5830] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6017] <... mprotect resumed>) = 0 [pid 5830] <... umount2 resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6017] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] rmdir("./14" [pid 5830] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6017] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] <... rmdir resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] getdents64(4, [pid 5830] newfstatat(AT_FDCWD, "./14/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6017] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5832] mkdir("./15", 0777 [pid 5829] getdents64(4, [pid 5832] <... mkdir resumed>) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] close(4./strace-static-x86_64: Process 6018 attached [pid 5830] <... openat resumed>) = 4 [pid 5829] <... close resumed>) = 0 [pid 6018] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5830] newfstatat(4, "", [pid 5829] rmdir("./13/file1" [pid 6018] <... rseq resumed>) = 0 [pid 6017] <... clone3 resumed> => {parent_tid=[6018]}, 88) = 6018 [pid 5832] <... openat resumed>) = 3 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6018] set_robust_list(0x7f476942f9a0, 24 [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5830] getdents64(4, [pid 5829] <... rmdir resumed>) = 0 [pid 6018] <... set_robust_list resumed>) = 0 [pid 6017] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... ioctl resumed>) = 0 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] umount2("./13/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6018] rt_sigprocmask(SIG_SETMASK, [], [pid 6017] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6018] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6017] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] close(3 [pid 5830] getdents64(4, [pid 5832] <... close resumed>) = 0 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6018] memfd_create("syzkaller", 0 [pid 6017] <... futex resumed>) = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5830] close(4 [pid 5829] newfstatat(AT_FDCWD, "./13/binderfs", ./strace-static-x86_64: Process 6019 attached [pid 6017] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5830] <... close resumed>) = 0 [pid 6018] <... memfd_create resumed>) = 3 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 6019 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] rmdir("./14/file1" [pid 5829] unlink("./13/binderfs" [pid 6018] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5830] <... rmdir resumed>) = 0 [pid 6019] set_robust_list(0x5555612166a0, 24 [pid 6018] <... mmap resumed>) = 0x7f4761000000 [pid 5829] <... unlink resumed>) = 0 [pid 6019] <... set_robust_list resumed>) = 0 [pid 5829] getdents64(3, [pid 6019] chdir("./15") = 0 [pid 6019] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6019] setpgid(0, 0) = 0 [pid 6018] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6019] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6019] <... openat resumed>) = 3 [pid 6018] <... write resumed>) = 131072 [pid 5829] close(3) = 0 [pid 6019] write(3, "1000", 4 [pid 5829] rmdir("./13" [pid 6019] <... write resumed>) = 4 [pid 6019] close(3) = 0 [pid 6019] symlink("/dev/binderfs", "./binderfs" [pid 5830] umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... rmdir resumed>) = 0 [pid 6018] munmap(0x7f4761000000, 138412032 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] mkdir("./14", 0777 [pid 6018] <... munmap resumed>) = 0 [pid 5830] newfstatat(AT_FDCWD, "./14/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] unlink("./14/binderfs") = 0 [pid 5829] <... mkdir resumed>) = 0 executing program [pid 6019] <... symlink resumed>) = 0 [pid 5830] getdents64(3, [pid 6019] write(1, "executing program\n", 18 [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6019] <... write resumed>) = 18 [pid 5830] close(3 [pid 6019] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... close resumed>) = 0 [pid 6019] <... futex resumed>) = 0 [pid 5830] rmdir("./14" [pid 6019] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5830] <... rmdir resumed>) = 0 [pid 6019] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5830] mkdir("./15", 0777 [pid 6019] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5830] <... mkdir resumed>) = 0 [pid 6019] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6019] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 6019] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6019] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5830] <... openat resumed>) = 3 [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 6019] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5830] <... ioctl resumed>) = 0 [pid 6019] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 6020 attached [pid 5830] close(3 [pid 5829] <... openat resumed>) = 3 [pid 6019] <... clone3 resumed> => {parent_tid=[6020]}, 88) = 6020 [pid 5830] <... close resumed>) = 0 [pid 6020] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6019] rt_sigprocmask(SIG_SETMASK, [], [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6020] <... rseq resumed>) = 0 [pid 6018] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5829] ioctl(3, LOOP_CLR_FD [pid 6020] set_robust_list(0x7f476942f9a0, 24 [pid 6019] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6018] <... openat resumed>) = 4 [pid 5829] <... ioctl resumed>) = 0 ./strace-static-x86_64: Process 6021 attached [pid 6020] <... set_robust_list resumed>) = 0 [pid 6019] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 6021 [pid 6020] rt_sigprocmask(SIG_SETMASK, [], [pid 6019] <... futex resumed>) = 0 [pid 6021] set_robust_list(0x5555612166a0, 24 [pid 6020] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6019] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6018] ioctl(4, LOOP_SET_FD, 3 [pid 5829] close(3 [pid 6021] <... set_robust_list resumed>) = 0 [pid 6020] memfd_create("syzkaller", 0 [pid 5829] <... close resumed>) = 0 [pid 6021] chdir("./15" [pid 6020] <... memfd_create resumed>) = 3 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6021] <... chdir resumed>) = 0 [pid 6020] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6021] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6020] <... mmap resumed>) = 0x7f4761000000 [pid 6021] <... prctl resumed>) = 0 [pid 6021] setpgid(0, 0) = 0 ./strace-static-x86_64: Process 6022 attached [pid 6021] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6022] set_robust_list(0x5555612166a0, 24 [pid 6021] <... openat resumed>) = 3 [pid 6022] <... set_robust_list resumed>) = 0 [pid 6021] write(3, "1000", 4 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 6022 [pid 6022] chdir("./14" [pid 6021] <... write resumed>) = 4 [ 107.620101][ T6014] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6021] close(3) = 0 [pid 6020] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6021] symlink("/dev/binderfs", "./binderfs" [pid 6022] <... chdir resumed>) = 0 [pid 6022] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6021] <... symlink resumed>) = 0 [pid 6020] <... write resumed>) = 131072 [pid 6022] <... prctl resumed>) = 0 [pid 6021] write(1, "executing program\n", 18 [pid 6022] setpgid(0, 0) = 0 [pid 6022] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 executing program [pid 6020] munmap(0x7f4761000000, 138412032 [pid 6022] write(3, "1000", 4 [pid 6021] <... write resumed>) = 18 [pid 6020] <... munmap resumed>) = 0 [pid 6022] <... write resumed>) = 4 [pid 6021] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6020] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6022] close(3 [pid 6021] <... futex resumed>) = 0 [pid 6020] <... openat resumed>) = 4 [pid 6021] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 6020] ioctl(4, LOOP_SET_FD, 3 [pid 6022] <... close resumed>) = 0 [pid 6021] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6018] <... ioctl resumed>) = 0 [pid 6014] <... mount resumed>) = 0 [pid 6021] <... rt_sigprocmask resumed>NULL, 8) = 0 executing program [pid 6018] close(3 [pid 6022] symlink("/dev/binderfs", "./binderfs" [pid 6018] <... close resumed>) = 0 [pid 6022] <... symlink resumed>) = 0 [pid 6021] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6022] write(1, "executing program\n", 18 [pid 6021] <... mmap resumed>) = 0x7f476940f000 [pid 6022] <... write resumed>) = 18 [pid 6021] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6022] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6021] <... mprotect resumed>) = 0 [pid 6018] close(4 [pid 6014] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6018] <... close resumed>) = 0 [pid 6022] <... futex resumed>) = 0 [pid 6021] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6018] mkdir("./file1", 0777 [pid 6014] <... openat resumed>) = 3 [pid 6022] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6021] <... rt_sigprocmask resumed>[], 8) = 0 [ 107.694265][ T6018] loop2: detected capacity change from 0 to 256 [ 107.720751][ T6020] loop3: detected capacity change from 0 to 256 [pid 6022] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6021] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6020] <... ioctl resumed>) = 0 [pid 6018] <... mkdir resumed>) = 0 [pid 6014] chdir("./file1" [pid 6022] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6018] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 6014] <... chdir resumed>) = 0 ./strace-static-x86_64: Process 6023 attached [pid 6022] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6021] <... clone3 resumed> => {parent_tid=[6023]}, 88) = 6023 [pid 6020] close(3 [pid 6023] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6022] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6021] rt_sigprocmask(SIG_SETMASK, [], [pid 6020] <... close resumed>) = 0 [pid 6023] <... rseq resumed>) = 0 [pid 6022] <... mmap resumed>) = 0x7f476940f000 [pid 6021] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6020] close(4 [pid 6023] set_robust_list(0x7f476942f9a0, 24 [pid 6022] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6021] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6020] <... close resumed>) = 0 [pid 6023] <... set_robust_list resumed>) = 0 [pid 6022] <... mprotect resumed>) = 0 [pid 6021] <... futex resumed>) = 0 [pid 6020] mkdir("./file1", 0777 [pid 6023] rt_sigprocmask(SIG_SETMASK, [], [pid 6022] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6021] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6020] <... mkdir resumed>) = 0 [pid 6014] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 6023] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6022] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6020] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 6023] memfd_create("syzkaller", 0 [pid 6022] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6014] <... openat resumed>) = -1 EBUSY (Device or resource busy) ./strace-static-x86_64: Process 6024 attached [pid 6023] <... memfd_create resumed>) = 3 [pid 6023] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6022] <... clone3 resumed> => {parent_tid=[6024]}, 88) = 6024 [pid 6023] <... mmap resumed>) = 0x7f4761000000 [pid 6023] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6022] rt_sigprocmask(SIG_SETMASK, [], [pid 6024] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6022] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6024] <... rseq resumed>) = 0 [pid 6022] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6024] set_robust_list(0x7f476942f9a0, 24 [pid 6022] <... futex resumed>) = 0 [pid 6024] <... set_robust_list resumed>) = 0 [pid 6022] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6024] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6023] <... write resumed>) = 131072 [pid 6024] memfd_create("syzkaller", 0 [pid 6014] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6024] <... memfd_create resumed>) = 3 [pid 6023] munmap(0x7f4761000000, 138412032 [pid 6024] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6023] <... munmap resumed>) = 0 [pid 6014] <... futex resumed>) = 1 [pid 6013] <... futex resumed>) = 0 [pid 6024] <... mmap resumed>) = 0x7f4761000000 [pid 6014] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6013] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 107.820482][ T6018] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6014] <... openat resumed>) = 4 [pid 6013] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6014] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6024] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6023] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 6023] ioctl(4, LOOP_SET_FD, 3 [pid 6024] <... write resumed>) = 131072 [pid 6014] <... futex resumed>) = 1 [pid 6013] <... futex resumed>) = 0 [pid 6013] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6024] munmap(0x7f4761000000, 138412032 [pid 6018] <... mount resumed>) = 0 [pid 6014] mkdir("./file2", 0777 [pid 6013] <... futex resumed>) = 0 [pid 6018] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6013] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6024] <... munmap resumed>) = 0 [ 107.862499][ T6020] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 107.872282][ T6023] loop1: detected capacity change from 0 to 256 [pid 6024] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6024] ioctl(4, LOOP_SET_FD, 3 [pid 6018] <... openat resumed>) = 3 [pid 6018] chdir("./file1") = 0 [pid 6018] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 6020] <... mount resumed>) = 0 [pid 6018] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6017] <... futex resumed>) = 0 [pid 6020] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6018] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6017] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6014] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6024] <... ioctl resumed>) = 0 [pid 6023] <... ioctl resumed>) = 0 [pid 6020] <... openat resumed>) = 3 [pid 6018] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6017] <... futex resumed>) = 0 [pid 6014] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6020] chdir("./file1" [pid 6018] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6017] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6020] <... chdir resumed>) = 0 [pid 6020] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 6023] close(3) = 0 [pid 6024] close(3 [pid 6023] close(4 [pid 6024] <... close resumed>) = 0 [pid 6023] <... close resumed>) = 0 [pid 6018] <... openat resumed>) = 4 [pid 6024] close(4 [pid 6023] mkdir("./file1", 0777 [pid 6020] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6018] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6013] <... futex resumed>) = ? [pid 6018] <... futex resumed>) = 1 [pid 6017] <... futex resumed>) = 0 [pid 6024] <... close resumed>) = 0 [pid 6023] <... mkdir resumed>) = 0 [pid 6020] <... futex resumed>) = 1 [pid 6019] <... futex resumed>) = 0 [ 107.909343][ T6014] exFAT-fs (loop4): error, data size is invalid(9000) [ 107.929068][ T6024] loop0: detected capacity change from 0 to 256 [ 107.939088][ T6014] exFAT-fs (loop4): Filesystem has been set read-only [pid 6018] mkdir("./file2", 0777 [pid 6017] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6024] mkdir("./file1", 0777 [pid 6023] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 6020] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6019] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6024] <... mkdir resumed>) = 0 [pid 6019] <... futex resumed>) = 0 [pid 6017] <... futex resumed>) = 0 [pid 6020] <... openat resumed>) = 4 [pid 6017] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6014] +++ killed by SIGSEGV +++ [pid 6013] +++ killed by SIGSEGV +++ [pid 6020] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6019] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6020] <... futex resumed>) = 0 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6013, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 6020] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6019] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5833] umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6019] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6024] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 6019] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6020] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5833] <... openat resumed>) = 3 [pid 6020] mkdir("./file2", 0777 [pid 6018] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5833] newfstatat(3, "", [pid 6018] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 107.983659][ T6018] exFAT-fs (loop2): error, data size is invalid(9000) [ 108.014580][ T6018] exFAT-fs (loop2): Filesystem has been set read-only [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6017] <... futex resumed>) = ? [pid 6018] +++ killed by SIGSEGV +++ [pid 6017] +++ killed by SIGSEGV +++ [pid 5833] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 6019] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6017, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 6019] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6019] <... futex resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6019] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5831] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6019] <... mmap resumed>) = 0x7f47693ee000 [pid 5831] <... openat resumed>) = 3 [pid 6019] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5831] newfstatat(3, "", [pid 6019] <... mprotect resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6019] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5831] getdents64(3, [pid 6019] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5833] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6019] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5831] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 6025 attached [pid 6019] <... clone3 resumed> => {parent_tid=[6025]}, 88) = 6025 [pid 6019] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] <... umount2 resumed>) = 0 [pid 6025] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6019] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6025] <... rseq resumed>) = 0 [pid 6019] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6025] set_robust_list(0x7f476940e9a0, 24 [pid 6019] <... futex resumed>) = 0 [pid 6025] <... set_robust_list resumed>) = 0 [pid 6019] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6025] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6025] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] newfstatat(AT_FDCWD, "./15/file1", [pid 5831] <... umount2 resumed>) = 0 [pid 6025] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6025] <... ioctl resumed>) = 0 [pid 5833] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] newfstatat(AT_FDCWD, "./15/file1", [pid 6025] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6019] <... futex resumed>) = 0 [ 108.050496][ T6020] exFAT-fs (loop3): error, data size is invalid(9000) [ 108.063947][ T6020] exFAT-fs (loop3): Filesystem has been set read-only [ 108.115097][ T6024] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6025] futex(0x7f47695046d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6020] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5833] <... openat resumed>) = 4 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] newfstatat(4, "", [pid 6020] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] getdents64(4, [pid 5831] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] getdents64(4, [pid 5831] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6020] +++ killed by SIGSEGV +++ [pid 5833] close(4 [pid 6025] <... futex resumed>) = ? [pid 5833] <... close resumed>) = 0 [pid 5831] <... openat resumed>) = 4 [pid 6025] +++ killed by SIGSEGV +++ [pid 6019] +++ killed by SIGSEGV +++ [pid 5833] rmdir("./15/file1" [pid 5831] newfstatat(4, "", [pid 5833] <... rmdir resumed>) = 0 [pid 5833] umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6019, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] restart_syscall(<... resuming interrupted clone ...> [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5833] newfstatat(AT_FDCWD, "./15/binderfs", [pid 5832] <... restart_syscall resumed>) = 0 [pid 5831] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] close(4 [pid 5832] umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... close resumed>) = 0 [pid 5833] unlink("./15/binderfs" [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] rmdir("./15/file1") = 0 [pid 5832] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6024] <... mount resumed>) = 0 [pid 5832] <... openat resumed>) = 3 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6024] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5833] <... unlink resumed>) = 0 [pid 5832] newfstatat(3, "", [pid 5831] newfstatat(AT_FDCWD, "./15/binderfs", [pid 6024] chdir("./file1") = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6024] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5832] getdents64(3, [pid 6024] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5831] unlink("./15/binderfs" [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6024] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6024] <... futex resumed>) = 1 [pid 6024] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6023] <... mount resumed>) = 0 [pid 5831] <... unlink resumed>) = 0 [pid 6022] <... futex resumed>) = 0 [ 108.156304][ T6023] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6022] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6024] <... futex resumed>) = 0 [pid 6023] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5832] <... umount2 resumed>) = 0 [pid 5831] getdents64(3, [pid 6023] <... openat resumed>) = 3 [pid 6024] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5832] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6023] chdir("./file1" [pid 5831] close(3 [pid 6023] <... chdir resumed>) = 0 [pid 6023] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 6023] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6021] <... futex resumed>) = 0 [pid 6021] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6022] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6021] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... close resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6024] <... openat resumed>) = 4 [pid 6023] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6024] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6022] <... futex resumed>) = 0 [pid 6022] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] newfstatat(AT_FDCWD, "./15/file1", [pid 5831] rmdir("./15" [pid 6024] mkdir("./file2", 0777 [pid 6023] <... openat resumed>) = 4 [pid 6022] <... futex resumed>) = 0 [pid 6023] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6022] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] getdents64(3, [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] <... rmdir resumed>) = 0 [pid 5833] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] mkdir("./16", 0777 [pid 5833] close(3 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5833] <... close resumed>) = 0 [pid 5831] <... mkdir resumed>) = 0 [pid 6023] <... futex resumed>) = 1 [pid 6023] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5833] rmdir("./15" [pid 5832] <... openat resumed>) = 4 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6021] <... futex resumed>) = 0 [pid 6021] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6023] <... futex resumed>) = 0 [pid 6023] mkdir("./file2", 0777 [pid 5833] <... rmdir resumed>) = 0 [pid 5832] newfstatat(4, "", [pid 5831] <... openat resumed>) = 3 [pid 6021] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] ioctl(3, LOOP_CLR_FD [ 108.236181][ T6024] exFAT-fs (loop0): error, data size is invalid(9000) [ 108.259458][ T6023] exFAT-fs (loop1): error, data size is invalid(9000) [pid 5833] mkdir("./16", 0777 [pid 5831] <... ioctl resumed>) = 0 [pid 5833] <... mkdir resumed>) = 0 [pid 5832] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] close(3 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5832] getdents64(4, [pid 5831] <... close resumed>) = 0 [pid 5833] <... openat resumed>) = 3 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5832] close(4 [pid 5833] <... ioctl resumed>) = 0 [pid 5832] <... close resumed>) = 0 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 6027 [pid 6022] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 6022] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] rmdir("./15/file1" [pid 5833] close(3 [pid 6022] <... futex resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 6022] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 6022] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5832] <... rmdir resumed>) = 0 [pid 6022] rt_sigprocmask(SIG_BLOCK, ~[], executing program [], 8) = 0 [pid 6022] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} => {parent_tid=[6028]}, 88) = 6028 [pid 6022] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 6027 attached [pid 6022] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6022] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5832] umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6027] set_robust_list(0x5555612166a0, 24) = 0 [pid 6027] chdir("./16") = 0 [pid 6027] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6027] setpgid(0, 0) = 0 [pid 6027] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC./strace-static-x86_64: Process 6028 attached ) = 3 [pid 6027] write(3, "1000", 4) = 4 [pid 6027] close(3) = 0 [pid 6028] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6027] symlink("/dev/binderfs", "./binderfs" [pid 6028] <... rseq resumed>) = 0 [pid 6028] set_robust_list(0x7f476940e9a0, 24 [pid 6027] <... symlink resumed>) = 0 [pid 6028] <... set_robust_list resumed>) = 0 [pid 6028] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6028] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 6027] write(1, "executing program\n", 18) = 18 [pid 6027] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6027] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 6027] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6028] <... ioctl resumed>) = 0 [pid 6021] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 6029 attached [pid 6028] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6027] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6021] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] newfstatat(AT_FDCWD, "./15/binderfs", [pid 6029] set_robust_list(0x5555612166a0, 24 [pid 6028] <... futex resumed>) = 1 [pid 6027] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6022] <... futex resumed>) = 0 [pid 6021] <... futex resumed>) = 0 [pid 6029] <... set_robust_list resumed>) = 0 [pid 6028] futex(0x7f47695046d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6027] <... mmap resumed>) = 0x7f476940f000 [pid 6024] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6023] <... mkdir resumed>) = -1 EIO (Input/output error) [ 108.278589][ T6024] exFAT-fs (loop0): Filesystem has been set read-only [ 108.298530][ T6023] exFAT-fs (loop1): Filesystem has been set read-only [pid 6021] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 6029 [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6029] chdir("./16" [pid 6027] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6024] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6029] <... chdir resumed>) = 0 [pid 6029] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6028] <... futex resumed>) = ? [pid 6027] <... mprotect resumed>) = 0 [pid 6023] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6021] <... mmap resumed>) = 0x7f47693ee000 [pid 5832] unlink("./15/binderfs" [pid 6029] <... prctl resumed>) = 0 [pid 6029] setpgid(0, 0 [pid 6028] +++ killed by SIGSEGV +++ [pid 6029] <... setpgid resumed>) = 0 [pid 6027] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6023] +++ killed by SIGSEGV +++ [pid 6021] +++ killed by SIGSEGV +++ [pid 5832] <... unlink resumed>) = 0 [pid 6029] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5832] getdents64(3, [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6021, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5830] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5832] close(3 [pid 6029] <... openat resumed>) = 3 [pid 6027] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] <... close resumed>) = 0 [pid 6027] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5830] umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] rmdir("./15" [pid 6029] write(3, "1000", 4 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6027] <... clone3 resumed> => {parent_tid=[6030]}, 88) = 6030 [pid 6029] <... write resumed>) = 4 [pid 6027] rt_sigprocmask(SIG_SETMASK, [], [pid 6024] +++ killed by SIGSEGV +++ [pid 6022] +++ killed by SIGSEGV +++ [pid 5832] <... rmdir resumed>) = 0 [pid 5830] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6027] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6027] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 6030 attached [pid 6027] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6029] close(3 [pid 5830] <... openat resumed>) = 3 [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6022, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 6029] <... close resumed>) = 0 [pid 5830] newfstatat(3, "", [pid 5829] restart_syscall(<... resuming interrupted clone ...> [pid 6029] symlink("/dev/binderfs", "./binderfs" [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6030] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053) = 0 [pid 6030] set_robust_list(0x7f476942f9a0, 24) = 0 [pid 6030] rt_sigprocmask(SIG_SETMASK, [], [pid 6029] <... symlink resumed>) = 0 [pid 6030] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5830] getdents64(3, executing program [pid 5829] <... restart_syscall resumed>) = 0 [pid 6029] write(1, "executing program\n", 18 [pid 6030] memfd_create("syzkaller", 0 [pid 6029] <... write resumed>) = 18 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6030] <... memfd_create resumed>) = 3 [pid 5829] umount2("./14", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6029] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6029] <... futex resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6030] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 6029] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5829] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6029] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5832] mkdir("./16", 0777 [pid 5830] <... umount2 resumed>) = 0 [pid 5829] <... openat resumed>) = 3 [pid 6029] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5832] <... mkdir resumed>) = 0 [pid 5830] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] newfstatat(3, "", [pid 6029] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6030] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6029] <... mmap resumed>) = 0x7f476940f000 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6029] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5832] <... openat resumed>) = 3 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] getdents64(3, [pid 6029] <... mprotect resumed>) = 0 [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5830] newfstatat(AT_FDCWD, "./15/file1", [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6030] <... write resumed>) = 131072 [pid 6029] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] <... ioctl resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] close(3 [pid 5830] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6029] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] <... close resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6030] munmap(0x7f4761000000, 138412032 [pid 5830] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6030] <... munmap resumed>) = 0 [pid 5830] <... openat resumed>) = 4 [pid 6030] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 6030] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 6030] ioctl(4, LOOP_CLR_FD [pid 5830] newfstatat(4, "", [pid 6030] <... ioctl resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 6031 ./strace-static-x86_64: Process 6031 attached [pid 6029] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5830] getdents64(4, [pid 6030] ioctl(4, LOOP_SET_FD, 3 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6030] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 6030] close(4) = 0 [pid 5830] getdents64(4, ./strace-static-x86_64: Process 6032 attached [pid 6031] set_robust_list(0x5555612166a0, 24 [pid 6030] close(3 [pid 6029] <... clone3 resumed> => {parent_tid=[6032]}, 88) = 6032 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6029] rt_sigprocmask(SIG_SETMASK, [], [pid 5830] close(4 [pid 6031] <... set_robust_list resumed>) = 0 [pid 6030] <... close resumed>) = 0 [pid 5830] <... close resumed>) = 0 [pid 6030] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6027] <... futex resumed>) = 0 [pid 6031] chdir("./16" [pid 5830] rmdir("./15/file1" [pid 6027] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6027] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6030] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6032] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6030] <... openat resumed>) = 3 [pid 6029] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5830] <... rmdir resumed>) = 0 [pid 6032] <... rseq resumed>) = 0 [pid 5830] umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6032] set_robust_list(0x7f476942f9a0, 24) = 0 [pid 6031] <... chdir resumed>) = 0 [pid 6029] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... umount2 resumed>) = 0 [pid 5830] newfstatat(AT_FDCWD, "./15/binderfs", [pid 5829] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6030] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6031] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] newfstatat(AT_FDCWD, "./14/file1", [pid 6031] <... prctl resumed>) = 0 [pid 6030] <... futex resumed>) = 1 [pid 6029] <... futex resumed>) = 0 [pid 6027] <... futex resumed>) = 0 [pid 5830] unlink("./15/binderfs" [pid 6029] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6032] rt_sigprocmask(SIG_SETMASK, [], [pid 6030] mkdir("./file2", 0777 [pid 6027] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... unlink resumed>) = 0 [pid 5829] umount2("./14/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] getdents64(3, [pid 6032] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6031] setpgid(0, 0 [pid 6030] <... mkdir resumed>) = 0 [pid 6027] <... futex resumed>) = 0 [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6032] memfd_create("syzkaller", 0 [pid 6030] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6027] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] close(3 [pid 5829] openat(AT_FDCWD, "./14/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6032] <... memfd_create resumed>) = 3 [pid 6027] <... futex resumed>) = ? [pid 5830] <... close resumed>) = 0 [pid 5829] <... openat resumed>) = 4 [pid 6032] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6031] <... setpgid resumed>) = 0 [pid 6030] +++ killed by SIGSEGV +++ [pid 6027] +++ killed by SIGSEGV +++ [pid 6032] <... mmap resumed>) = 0x7f4761000000 [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6027, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=0} --- [pid 5829] newfstatat(4, "", [pid 6032] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6031] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5830] rmdir("./15" [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6032] <... write resumed>) = 131072 [pid 6031] <... openat resumed>) = 3 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... rmdir resumed>) = 0 [pid 5829] getdents64(4, [pid 6032] munmap(0x7f4761000000, 138412032 [pid 5831] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6032] <... munmap resumed>) = 0 [pid 6031] write(3, "1000", 4 [pid 5830] mkdir("./16", 0777 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6032] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5831] <... openat resumed>) = 3 [pid 6032] <... openat resumed>) = 4 [pid 6031] <... write resumed>) = 4 [pid 5830] <... mkdir resumed>) = 0 [pid 5829] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5831] newfstatat(3, "", [pid 6031] close(3 [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5829] close(4 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6031] <... close resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 6032] ioctl(4, LOOP_SET_FD, 3 [pid 6031] symlink("/dev/binderfs", "./binderfs" [pid 5831] getdents64(3, [pid 5830] <... openat resumed>) = 3 [pid 5829] rmdir("./14/file1" [pid 6032] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 6032] ioctl(4, LOOP_CLR_FD [pid 6031] <... symlink resumed>) = 0 [pid 6032] <... ioctl resumed>) = 0 [pid 6031] write(1, "executing program\n", 18 [pid 5831] <... getdents64 resumed>0x555561217730 /* 5 entries */, 32768) = 144 [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5829] <... rmdir resumed>) = 0 [pid 5831] umount2("./16/devices.list", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... ioctl resumed>) = 0 [pid 6032] ioctl(4, LOOP_SET_FD, 3 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) executing program [pid 5831] newfstatat(AT_FDCWD, "./16/devices.list", [pid 5830] close(3 [pid 5829] umount2("./14/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6032] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 5831] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6031] <... write resumed>) = 18 [pid 5830] <... close resumed>) = 0 [pid 5829] newfstatat(AT_FDCWD, "./14/binderfs", [pid 6032] close(4) = 0 [pid 6031] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6032] close(3 [pid 5829] unlink("./14/binderfs" [pid 6032] <... close resumed>) = 0 [pid 6032] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6032] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 6033 attached [pid 6031] <... futex resumed>) = 0 [pid 6029] <... futex resumed>) = 0 [pid 5831] unlink("./16/devices.list" [pid 5829] <... unlink resumed>) = 0 [pid 6029] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6033] set_robust_list(0x5555612166a0, 24 [pid 6031] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5831] <... unlink resumed>) = 0 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 6033 [pid 5829] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 6033] <... set_robust_list resumed>) = 0 [pid 6033] chdir("./16" [pid 6032] <... futex resumed>) = 0 [pid 6031] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6029] <... futex resumed>) = 1 [pid 5831] umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] close(3 [pid 6032] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 6029] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... close resumed>) = 0 [pid 6031] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6033] <... chdir resumed>) = 0 [pid 6031] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] newfstatat(AT_FDCWD, "./16/binderfs", [pid 5829] rmdir("./14" [pid 6033] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6031] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6032] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] <... rmdir resumed>) = 0 [pid 6032] <... futex resumed>) = 1 [pid 6032] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6029] <... futex resumed>) = 0 [pid 5829] mkdir("./15", 0777 [pid 6029] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6031] <... mmap resumed>) = 0x7f476940f000 [pid 5831] unlink("./16/binderfs" [pid 5829] <... mkdir resumed>) = 0 [pid 6033] <... prctl resumed>) = 0 [pid 6032] <... futex resumed>) = 0 [pid 6031] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6029] <... futex resumed>) = 1 [pid 6032] mkdir("./file2", 0777 [pid 6033] setpgid(0, 0 [pid 6032] <... mkdir resumed>) = 0 [pid 6031] <... mprotect resumed>) = 0 [pid 6029] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... unlink resumed>) = 0 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 6033] <... setpgid resumed>) = 0 [pid 6032] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6031] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6033] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6031] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5829] <... openat resumed>) = 3 [pid 6033] <... openat resumed>) = 3 [pid 6031] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5829] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 6034 attached [pid 6033] write(3, "1000", 4 [pid 5829] <... ioctl resumed>) = 0 [pid 6034] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6033] <... write resumed>) = 4 [pid 6031] <... clone3 resumed> => {parent_tid=[6034]}, 88) = 6034 [pid 5831] umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] close(3 [pid 6034] <... rseq resumed>) = 0 [pid 6033] close(3 [pid 6031] rt_sigprocmask(SIG_SETMASK, [], [pid 6029] <... futex resumed>) = ? [pid 6034] set_robust_list(0x7f476942f9a0, 24 [pid 6033] <... close resumed>) = 0 [pid 6032] +++ killed by SIGSEGV +++ [pid 6031] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6029] +++ killed by SIGSEGV +++ [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6034] <... set_robust_list resumed>) = 0 [pid 6033] symlink("/dev/binderfs", "./binderfs" [pid 6031] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6029, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5831] newfstatat(AT_FDCWD, "./16/file2", [pid 5829] <... close resumed>) = 0 [pid 6034] rt_sigprocmask(SIG_SETMASK, [], [pid 6033] <... symlink resumed>) = 0 [pid 6031] <... futex resumed>) = 0 [pid 5833] restart_syscall(<... resuming interrupted clone ...> [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5833] <... restart_syscall resumed>) = 0 executing program [pid 6034] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6031] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6034] memfd_create("syzkaller", 0 [pid 5833] umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6033] write(1, "executing program\n", 18 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6034] <... memfd_create resumed>) = 3 [pid 6033] <... write resumed>) = 18 [pid 5833] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6034] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6033] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... openat resumed>) = 3 [pid 5831] openat(AT_FDCWD, "./16/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6034] <... mmap resumed>) = 0x7f4761000000 [pid 6033] <... futex resumed>) = 0 [pid 5833] newfstatat(3, "", [pid 5831] <... openat resumed>) = 4 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] getdents64(3, ./strace-static-x86_64: Process 6035 attached [pid 6033] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5833] <... getdents64 resumed>0x555561217730 /* 5 entries */, 32768) = 144 [pid 5831] newfstatat(4, "", [pid 6033] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5833] umount2("./16/devices.list", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6033] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] getdents64(4, [pid 6033] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] newfstatat(AT_FDCWD, "./16/devices.list", [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6035] set_robust_list(0x5555612166a0, 24 [pid 6033] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] getdents64(4, [pid 6035] <... set_robust_list resumed>) = 0 [pid 6033] <... mmap resumed>) = 0x7f476940f000 [pid 5833] unlink("./16/devices.list" [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 6035 [pid 6035] chdir("./15" [pid 6033] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5833] <... unlink resumed>) = 0 [pid 5831] close(4 [pid 6035] <... chdir resumed>) = 0 [pid 6033] <... mprotect resumed>) = 0 [pid 5833] umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... close resumed>) = 0 [pid 6035] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6034] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6033] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] rmdir("./16/file2" [pid 6035] <... prctl resumed>) = 0 [pid 6033] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6035] setpgid(0, 0 [pid 6034] <... write resumed>) = 131072 [pid 6033] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5831] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 6036 attached [pid 6035] <... setpgid resumed>) = 0 [pid 5831] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] close(3 [pid 6035] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6033] <... clone3 resumed> => {parent_tid=[6036]}, 88) = 6036 [pid 5833] newfstatat(AT_FDCWD, "./16/binderfs", [pid 5831] <... close resumed>) = 0 [pid 6033] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] rmdir("./16" [pid 6033] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] unlink("./16/binderfs" [pid 5831] <... rmdir resumed>) = 0 [pid 6034] munmap(0x7f4761000000, 138412032 [pid 6033] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... unlink resumed>) = 0 [pid 6035] <... openat resumed>) = 3 [pid 6034] <... munmap resumed>) = 0 [pid 6033] <... futex resumed>) = 0 [pid 6036] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6035] write(3, "1000", 4 [pid 6033] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6036] <... rseq resumed>) = 0 [pid 6035] <... write resumed>) = 4 [pid 5833] umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] mkdir("./17", 0777 [pid 6036] set_robust_list(0x7f476942f9a0, 24 [pid 6035] close(3 [pid 6034] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6036] <... set_robust_list resumed>) = 0 [pid 6034] <... openat resumed>) = 4 [pid 5831] <... mkdir resumed>) = 0 [pid 6036] rt_sigprocmask(SIG_SETMASK, [], [pid 6034] ioctl(4, LOOP_SET_FD, 3 [pid 5833] newfstatat(AT_FDCWD, "./16/file2", [pid 6036] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6035] <... close resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6034] <... ioctl resumed>) = 0 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6035] symlink("/dev/binderfs", "./binderfs" [pid 6034] close(3 [pid 5831] <... openat resumed>) = 3 [pid 6036] memfd_create("syzkaller", 0 [pid 6035] <... symlink resumed>) = 0 [pid 6034] <... close resumed>) = 0 [pid 5833] umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6034] close(4 [pid 6036] <... memfd_create resumed>) = 3 [pid 6034] <... close resumed>) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] ioctl(3, LOOP_CLR_FD [pid 6036] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6034] mkdir("./file1", 0777 [pid 5833] openat(AT_FDCWD, "./16/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6036] <... mmap resumed>) = 0x7f4761000000 [pid 5831] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 6036] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6035] write(1, "executing program\n", 18executing program [pid 6034] <... mkdir resumed>) = 0 [pid 5833] <... openat resumed>) = 4 [pid 5831] close(3 [pid 6035] <... write resumed>) = 18 [pid 6036] <... write resumed>) = 131072 [pid 6035] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6034] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5833] newfstatat(4, "", [pid 5831] <... close resumed>) = 0 [pid 6035] <... futex resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6035] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 6035] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6035] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 6035] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6035] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6035] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} => {parent_tid=[6038]}, 88) = 6038 [pid 6035] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 6037 attached [pid 6035] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 6038 attached ) = 0 [pid 6035] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6038] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6037] set_robust_list(0x5555612166a0, 24 [pid 5833] getdents64(4, [pid 6038] <... rseq resumed>) = 0 [pid 6038] set_robust_list(0x7f476942f9a0, 24 [pid 6037] <... set_robust_list resumed>) = 0 [ 108.673367][ T6034] loop3: detected capacity change from 0 to 256 [pid 6037] chdir("./17" [pid 6038] <... set_robust_list resumed>) = 0 [pid 6037] <... chdir resumed>) = 0 [pid 6038] rt_sigprocmask(SIG_SETMASK, [], [pid 6037] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6038] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6037] <... prctl resumed>) = 0 [pid 6036] munmap(0x7f4761000000, 138412032 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 6037 [pid 6038] memfd_create("syzkaller", 0) = 3 [pid 6038] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 6038] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6037] setpgid(0, 0 [pid 6038] <... write resumed>) = 131072 [pid 6037] <... setpgid resumed>) = 0 [pid 6036] <... munmap resumed>) = 0 [pid 5833] getdents64(4, [pid 6037] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6038] munmap(0x7f4761000000, 138412032 [pid 6037] <... openat resumed>) = 3 [pid 6036] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6038] <... munmap resumed>) = 0 [pid 6037] write(3, "1000", 4) = 4 [pid 6037] close(3) = 0 [pid 6037] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6038] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5833] close(4 [pid 6036] <... openat resumed>) = 4 [pid 6038] ioctl(4, LOOP_SET_FD, 3 [pid 6037] write(1, "executing program\n", 18executing program ) = 18 [pid 6037] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6036] ioctl(4, LOOP_SET_FD, 3 [pid 6034] <... mount resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 5833] rmdir("./16/file2" [pid 6037] <... futex resumed>) = 0 [pid 6037] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5833] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5833] close(3) = 0 [pid 5833] rmdir("./16") = 0 [pid 5833] mkdir("./17", 0777 [pid 6037] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5833] <... mkdir resumed>) = 0 [pid 6037] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 6037] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] <... openat resumed>) = 3 [pid 6037] <... mmap resumed>) = 0x7f476940f000 [pid 5833] ioctl(3, LOOP_CLR_FD [pid 6037] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5833] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 6037] <... mprotect resumed>) = 0 [pid 5833] close(3 [pid 6037] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5833] <... close resumed>) = 0 [pid 6037] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6037] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 6039 ./strace-static-x86_64: Process 6040 attached ./strace-static-x86_64: Process 6039 attached [pid 6037] <... clone3 resumed> => {parent_tid=[6040]}, 88) = 6040 [pid 6034] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6037] rt_sigprocmask(SIG_SETMASK, [], [pid 6039] set_robust_list(0x5555612166a0, 24 [pid 6037] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6039] <... set_robust_list resumed>) = 0 [pid 6037] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6040] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6039] chdir("./17" [pid 6037] <... futex resumed>) = 0 [pid 6037] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6034] <... openat resumed>) = 3 [pid 6034] chdir("./file1") = 0 [pid 6040] <... rseq resumed>) = 0 [pid 6039] <... chdir resumed>) = 0 [pid 6040] set_robust_list(0x7f476942f9a0, 24 [pid 6039] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6038] <... ioctl resumed>) = 0 [pid 6034] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6040] <... set_robust_list resumed>) = 0 [pid 6039] <... prctl resumed>) = 0 [pid 6036] <... ioctl resumed>) = 0 [ 108.747396][ T6034] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 108.774876][ T6038] loop0: detected capacity change from 0 to 256 [ 108.787623][ T6036] loop1: detected capacity change from 0 to 256 [pid 6040] rt_sigprocmask(SIG_SETMASK, [], [pid 6039] setpgid(0, 0 [pid 6036] close(3 [pid 6034] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6040] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6039] <... setpgid resumed>) = 0 [pid 6038] close(3 [pid 6034] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6039] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6040] memfd_create("syzkaller", 0 [pid 6038] <... close resumed>) = 0 [pid 6034] <... futex resumed>) = 1 [pid 6040] <... memfd_create resumed>) = 3 [pid 6038] close(4 [pid 6034] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6031] <... futex resumed>) = 0 [pid 6038] <... close resumed>) = 0 [pid 6036] <... close resumed>) = 0 [pid 6038] mkdir("./file1", 0777 [pid 6031] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6040] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6038] <... mkdir resumed>) = 0 [pid 6036] close(4 [pid 6040] <... mmap resumed>) = 0x7f4761000000 [pid 6034] <... futex resumed>) = 0 [pid 6031] <... futex resumed>) = 1 [pid 6040] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6039] <... openat resumed>) = 3 [pid 6038] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 6036] <... close resumed>) = 0 [pid 6034] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6031] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6040] <... write resumed>) = 131072 [pid 6039] write(3, "1000", 4 [pid 6036] mkdir("./file1", 0777 [pid 6039] <... write resumed>) = 4 [pid 6036] <... mkdir resumed>) = 0 [pid 6034] <... openat resumed>) = 4 [pid 6039] close(3 [pid 6040] munmap(0x7f4761000000, 138412032 [pid 6039] <... close resumed>) = 0 [pid 6040] <... munmap resumed>) = 0 [pid 6039] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6040] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6036] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 6034] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6034] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6031] <... futex resumed>) = 0 [pid 6040] <... openat resumed>) = 4 [pid 6039] write(1, "executing program\n", 18executing program [pid 6031] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6039] <... write resumed>) = 18 [pid 6039] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6040] ioctl(4, LOOP_SET_FD, 3 [pid 6039] <... futex resumed>) = 0 [pid 6034] <... futex resumed>) = 0 [pid 6031] <... futex resumed>) = 1 [pid 6034] mkdir("./file2", 0777 [pid 6031] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6039] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [ 108.883413][ T6040] loop2: detected capacity change from 0 to 256 [ 108.894751][ T6034] exFAT-fs (loop3): error, data size is invalid(9000) [ 108.904161][ T6034] exFAT-fs (loop3): Filesystem has been set read-only [pid 6039] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6039] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 6039] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6039] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6040] <... ioctl resumed>) = 0 [pid 6036] <... mount resumed>) = 0 [pid 6034] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6031] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 6040] close(3 [pid 6039] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6036] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6034] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6031] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6039] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6031] <... futex resumed>) = ? [pid 6039] <... clone3 resumed> => {parent_tid=[6041]}, 88) = 6041 [pid 6039] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6039] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6039] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 6041 attached [pid 6034] +++ killed by SIGSEGV +++ [pid 6031] +++ killed by SIGSEGV +++ [pid 6041] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6031, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 6041] <... rseq resumed>) = 0 [pid 6041] set_robust_list(0x7f476942f9a0, 24) = 0 [pid 6041] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6041] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6040] <... close resumed>) = 0 [pid 6036] <... openat resumed>) = 3 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6041] memfd_create("syzkaller", 0 [pid 6040] close(4 [pid 6036] chdir("./file1" [pid 5832] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6040] <... close resumed>) = 0 [pid 6036] <... chdir resumed>) = 0 [pid 6041] <... memfd_create resumed>) = 3 [pid 5832] <... openat resumed>) = 3 [pid 6041] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5832] newfstatat(3, "", [pid 6041] <... mmap resumed>) = 0x7f4761000000 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6041] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6040] mkdir("./file1", 0777 [pid 6036] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5832] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 5832] umount2("./16/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6040] <... mkdir resumed>) = 0 [pid 6041] <... write resumed>) = 131072 [ 108.922095][ T6036] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 108.947154][ T6038] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6040] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 6036] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6036] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6041] munmap(0x7f4761000000, 138412032 [pid 6036] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6041] <... munmap resumed>) = 0 [pid 6038] <... mount resumed>) = 0 [pid 6033] <... futex resumed>) = 0 [pid 6033] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6041] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 6041] ioctl(4, LOOP_SET_FD, 3 [pid 6036] <... futex resumed>) = 0 [pid 6033] <... futex resumed>) = 1 [pid 6038] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 6036] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6033] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] <... umount2 resumed>) = 0 [pid 5832] umount2("./16/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./16/file1", [pid 6038] chdir("./file1" [pid 6036] <... openat resumed>) = 4 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6036] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6038] <... chdir resumed>) = 0 [pid 6036] <... futex resumed>) = 1 [pid 6033] <... futex resumed>) = 0 [pid 5832] umount2("./16/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6036] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6033] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6036] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6033] <... futex resumed>) = 0 [pid 6038] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6036] mkdir("./file2", 0777 [pid 6033] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6038] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5832] openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6038] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... openat resumed>) = 4 [pid 6038] <... futex resumed>) = 1 [pid 6035] <... futex resumed>) = 0 [pid 5832] newfstatat(4, "", [pid 6038] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6035] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6035] <... futex resumed>) = 0 [pid 5832] getdents64(4, [pid 6035] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5832] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5832] close(4) = 0 [pid 5832] rmdir("./16/file1") = 0 [pid 5832] umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] unlink("./16/binderfs" [pid 6041] <... ioctl resumed>) = 0 [pid 5832] <... unlink resumed>) = 0 [ 109.030061][ T6041] loop4: detected capacity change from 0 to 256 [ 109.053900][ T6036] exFAT-fs (loop1): error, data size is invalid(9000) [ 109.071188][ T6036] exFAT-fs (loop1): Filesystem has been set read-only [pid 6041] close(3) = 0 [pid 5832] getdents64(3, [pid 6041] close(4 [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] close(3) = 0 [pid 5832] rmdir("./16") = 0 [pid 6041] <... close resumed>) = 0 [pid 6041] mkdir("./file1", 0777 [pid 5832] mkdir("./17", 0777) = 0 [pid 6041] <... mkdir resumed>) = 0 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 5832] ioctl(3, LOOP_CLR_FD) = 0 [pid 5832] close(3) = 0 [pid 6041] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6035] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 6035] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6035] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 6035] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6035] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6035] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0}./strace-static-x86_64: Process 6043 attached ./strace-static-x86_64: Process 6042 attached [pid 6042] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6035] <... clone3 resumed> => {parent_tid=[6042]}, 88) = 6042 [pid 6033] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 6038] <... openat resumed>) = 4 [pid 6036] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 6043 [pid 6035] rt_sigprocmask(SIG_SETMASK, [], [pid 6043] set_robust_list(0x5555612166a0, 24 [pid 6042] <... rseq resumed>) = 0 [pid 6035] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6043] <... set_robust_list resumed>) = 0 [pid 6042] set_robust_list(0x7f476940e9a0, 24 [pid 6038] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6036] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6035] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6033] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6038] <... futex resumed>) = 0 [pid 6035] <... futex resumed>) = 0 [pid 6033] <... futex resumed>) = ? [pid 6038] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6035] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6043] chdir("./17" [pid 6042] <... set_robust_list resumed>) = 0 [pid 6043] <... chdir resumed>) = 0 [pid 6042] rt_sigprocmask(SIG_SETMASK, [], [pid 6036] +++ killed by SIGSEGV +++ [pid 6033] +++ killed by SIGSEGV +++ [pid 6043] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6042] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6043] <... prctl resumed>) = 0 [pid 6042] mkdir("./file2", 0777 [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6033, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 6043] setpgid(0, 0 [pid 5830] restart_syscall(<... resuming interrupted clone ...> [pid 6043] <... setpgid resumed>) = 0 [pid 6040] <... mount resumed>) = 0 [pid 5830] <... restart_syscall resumed>) = 0 [pid 6043] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6040] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6043] write(3, "1000", 4) = 4 [pid 6040] <... openat resumed>) = 3 [pid 6040] chdir("./file1" [ 109.095154][ T6040] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 109.135878][ T6042] exFAT-fs (loop0): error, data size is invalid(9000) [pid 6043] close(3 [pid 6040] <... chdir resumed>) = 0 executing program [pid 5830] umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6040] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6043] <... close resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6043] symlink("/dev/binderfs", "./binderfs" [pid 6040] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5830] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6043] <... symlink resumed>) = 0 [pid 6040] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6043] write(1, "executing program\n", 18 [pid 5830] <... openat resumed>) = 3 [pid 6043] <... write resumed>) = 18 [pid 5830] newfstatat(3, "", [pid 6043] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6043] <... futex resumed>) = 0 [pid 6043] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5830] getdents64(3, [pid 6043] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6043] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6040] <... futex resumed>) = 1 [pid 6037] <... futex resumed>) = 0 [pid 6035] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 6043] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6037] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6035] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] umount2("./16/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6043] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6040] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6038] <... futex resumed>) = 0 [pid 6037] <... futex resumed>) = 0 [pid 6035] <... futex resumed>) = 1 [pid 6043] <... mmap resumed>) = 0x7f476940f000 [pid 6040] <... openat resumed>) = 4 [pid 6038] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 6037] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6035] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6043] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6040] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6038] <... ioctl resumed>) = 0 [pid 6043] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6038] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6043] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6038] <... futex resumed>) = 1 [pid 6035] <... futex resumed>) = 0 [pid 6043] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6038] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 6044 attached [pid 6042] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6040] <... futex resumed>) = 1 [pid 6037] <... futex resumed>) = 0 [pid 5830] <... umount2 resumed>) = 0 [pid 6044] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6043] <... clone3 resumed> => {parent_tid=[6044]}, 88) = 6044 [pid 6042] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6040] mkdir("./file2", 0777 [pid 6037] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] umount2("./16/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6044] <... rseq resumed>) = 0 [pid 6043] rt_sigprocmask(SIG_SETMASK, [], [pid 6044] set_robust_list(0x7f476942f9a0, 24 [pid 6043] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6044] <... set_robust_list resumed>) = 0 [pid 6043] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] newfstatat(AT_FDCWD, "./16/file1", [pid 6044] rt_sigprocmask(SIG_SETMASK, [], [pid 6043] <... futex resumed>) = 0 [pid 6044] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6043] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6044] memfd_create("syzkaller", 0) = 3 [pid 5830] umount2("./16/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6044] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6044] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6037] <... futex resumed>) = 0 [ 109.184949][ T6042] exFAT-fs (loop0): Filesystem has been set read-only [ 109.206742][ T6040] exFAT-fs (loop2): error, data size is invalid(9000) [ 109.216945][ T6041] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6044] <... write resumed>) = 131072 [pid 6038] <... futex resumed>) = ? [pid 6037] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] openat(AT_FDCWD, "./16/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6038] +++ killed by SIGSEGV +++ [pid 6042] +++ killed by SIGSEGV +++ [pid 6040] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6035] +++ killed by SIGSEGV +++ [pid 5830] <... openat resumed>) = 4 [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6035, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 6044] munmap(0x7f4761000000, 138412032 [pid 5830] newfstatat(4, "", [pid 6044] <... munmap resumed>) = 0 [pid 6040] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6044] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6037] <... futex resumed>) = ? [pid 5830] getdents64(4, [pid 5829] umount2("./15", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] getdents64(4, [pid 5829] openat(AT_FDCWD, "./15", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] <... openat resumed>) = 3 [pid 5830] close(4 [pid 5829] newfstatat(3, "", [pid 5830] <... close resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] rmdir("./16/file1" [pid 5829] getdents64(3, [pid 5830] <... rmdir resumed>) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] unlink("./16/binderfs" [pid 6040] +++ killed by SIGSEGV +++ [pid 6037] +++ killed by SIGSEGV +++ [pid 5830] <... unlink resumed>) = 0 [pid 6044] <... openat resumed>) = 4 [pid 5830] getdents64(3, [pid 6044] ioctl(4, LOOP_SET_FD, 3 [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6037, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6041] <... mount resumed>) = 0 [pid 5830] close(3 [pid 5829] <... umount2 resumed>) = 0 [pid 5830] <... close resumed>) = 0 [pid 5829] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] rmdir("./16" [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... rmdir resumed>) = 0 [pid 5829] newfstatat(AT_FDCWD, "./15/file1", [pid 6041] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5831] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] mkdir("./17", 0777 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6041] chdir("./file1" [pid 5831] <... openat resumed>) = 3 [pid 5830] <... mkdir resumed>) = 0 [pid 5829] umount2("./15/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] newfstatat(3, "", [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] <... openat resumed>) = 3 [pid 5829] openat(AT_FDCWD, "./15/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6041] <... chdir resumed>) = 0 [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5829] <... openat resumed>) = 4 [pid 6041] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5830] <... ioctl resumed>) = 0 [pid 5830] close(3 [pid 5829] newfstatat(4, "", [pid 6041] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5830] <... close resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6041] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 6045 [pid 5829] getdents64(4, [pid 6041] <... futex resumed>) = 1 [pid 6039] <... futex resumed>) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 6045 attached [pid 6041] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6039] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] getdents64(3, [pid 6045] set_robust_list(0x5555612166a0, 24 [pid 6039] <... futex resumed>) = 0 [pid 5829] close(4 [pid 6045] <... set_robust_list resumed>) = 0 [pid 6039] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6045] chdir("./17" [pid 6041] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5829] <... close resumed>) = 0 [pid 6045] <... chdir resumed>) = 0 [pid 5831] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6045] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5829] rmdir("./15/file1" [pid 6045] <... prctl resumed>) = 0 [pid 5829] <... rmdir resumed>) = 0 [pid 6045] setpgid(0, 0 [pid 5829] umount2("./15/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6045] <... setpgid resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6045] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6041] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5829] newfstatat(AT_FDCWD, "./15/binderfs", [pid 6045] <... openat resumed>) = 3 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6045] write(3, "1000", 4 [pid 5829] unlink("./15/binderfs" [pid 6045] <... write resumed>) = 4 [pid 6041] <... openat resumed>) = 4 [pid 5829] <... unlink resumed>) = 0 [pid 6045] close(3) = 0 [ 109.216997][ T6040] exFAT-fs (loop2): Filesystem has been set read-only [ 109.267582][ T6044] loop3: detected capacity change from 0 to 256 [pid 6045] symlink("/dev/binderfs", "./binderfs"executing program ) = 0 [pid 6045] write(1, "executing program\n", 18) = 18 [pid 6045] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6045] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 5831] <... umount2 resumed>) = 0 [pid 6045] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5829] getdents64(3, [pid 6045] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6045] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6045] <... mmap resumed>) = 0x7f476940f000 [pid 6044] <... ioctl resumed>) = 0 [pid 5831] newfstatat(AT_FDCWD, "./17/file1", [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6045] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6044] close(3 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] close(3 [pid 6045] <... mprotect resumed>) = 0 [pid 6044] <... close resumed>) = 0 [pid 5831] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... close resumed>) = 0 [pid 6045] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6044] close(4 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] rmdir("./15" [pid 6045] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5831] openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6045] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6044] <... close resumed>) = 0 ./strace-static-x86_64: Process 6046 attached [pid 6044] mkdir("./file1", 0777 [pid 5831] <... openat resumed>) = 4 [pid 6045] <... clone3 resumed> => {parent_tid=[6046]}, 88) = 6046 [pid 6041] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6041] <... futex resumed>) = 1 [pid 6039] <... futex resumed>) = 0 [pid 5831] getdents64(4, [pid 6041] mkdir("./file2", 0777 [pid 6039] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6046] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6039] <... futex resumed>) = 0 [pid 5831] getdents64(4, [pid 6045] rt_sigprocmask(SIG_SETMASK, [], [pid 6039] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6046] <... rseq resumed>) = 0 [pid 6045] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5829] <... rmdir resumed>) = 0 [pid 6045] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] mkdir("./16", 0777 [pid 6046] set_robust_list(0x7f476942f9a0, 24 [pid 6045] <... futex resumed>) = 0 [pid 5829] <... mkdir resumed>) = 0 [pid 6046] <... set_robust_list resumed>) = 0 [pid 6045] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 6046] rt_sigprocmask(SIG_SETMASK, [], [pid 5829] <... openat resumed>) = 3 [pid 6046] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5829] ioctl(3, LOOP_CLR_FD [pid 6046] memfd_create("syzkaller", 0 [pid 5829] <... ioctl resumed>) = 0 [pid 6046] <... memfd_create resumed>) = 3 [pid 5829] close(3 [pid 6046] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5831] close(4 [pid 5829] <... close resumed>) = 0 [pid 6044] <... mkdir resumed>) = 0 [pid 5831] <... close resumed>) = 0 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6046] <... mmap resumed>) = 0x7f4761000000 [pid 6044] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5831] rmdir("./17/file1"./strace-static-x86_64: Process 6047 attached ) = 0 [pid 5831] umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 6047 [pid 6047] set_robust_list(0x5555612166a0, 24 [pid 6046] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5831] newfstatat(AT_FDCWD, "./17/binderfs", [pid 6047] <... set_robust_list resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6047] chdir("./16" [pid 5831] unlink("./17/binderfs") = 0 [pid 5831] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 6047] <... chdir resumed>) = 0 [pid 6046] <... write resumed>) = 131072 [pid 5831] close(3 [pid 6047] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6047] setpgid(0, 0 [pid 6046] munmap(0x7f4761000000, 138412032 [pid 5831] <... close resumed>) = 0 [pid 6047] <... setpgid resumed>) = 0 [pid 6046] <... munmap resumed>) = 0 [ 109.334609][ T6041] exFAT-fs (loop4): error, data size is invalid(9000) [pid 5831] rmdir("./17" [pid 6047] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6046] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5831] <... rmdir resumed>) = 0 [pid 6047] <... openat resumed>) = 3 [pid 6046] <... openat resumed>) = 4 [pid 6046] ioctl(4, LOOP_SET_FD, 3 [pid 6047] write(3, "1000", 4) = 4 [pid 6047] close(3 [pid 5831] mkdir("./18", 0777 [pid 6047] <... close resumed>) = 0 [pid 5831] <... mkdir resumed>) = 0 [pid 6047] symlink("/dev/binderfs", "./binderfs" [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6047] <... symlink resumed>) = 0 [pid 6039] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) executing program [pid 6047] write(1, "executing program\n", 18 [pid 6039] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... openat resumed>) = 3 [pid 6039] <... futex resumed>) = 0 [pid 6047] <... write resumed>) = 18 [pid 6039] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5831] ioctl(3, LOOP_CLR_FD [pid 6047] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... ioctl resumed>) = 0 [pid 6047] <... futex resumed>) = 0 [ 109.385423][ T6046] loop1: detected capacity change from 0 to 256 [ 109.394663][ T6041] exFAT-fs (loop4): Filesystem has been set read-only [pid 5831] close(3 [pid 6047] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6039] <... mmap resumed>) = 0x7f47693ee000 [pid 5831] <... close resumed>) = 0 [pid 6047] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6047] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6047] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6039] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 6047] <... mmap resumed>) = 0x7f476940f000 [pid 6047] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6039] <... mprotect resumed>) = 0 [pid 6047] <... mprotect resumed>) = 0 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6039] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6047] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6046] <... ioctl resumed>) = 0 [pid 6047] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6046] close(3) = 0 [pid 6047] <... clone3 resumed> => {parent_tid=[6048]}, 88) = 6048 [pid 6046] close(4 [pid 6047] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6047] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6047] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6046] <... close resumed>) = 0 [pid 6039] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6046] mkdir("./file1", 0777 [pid 6039] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 6046] <... mkdir resumed>) = 0 [pid 6046] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 6039] <... clone3 resumed> => {parent_tid=[6049]}, 88) = 6049 [pid 6039] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 6048 attached NULL, 8) = 0 ./strace-static-x86_64: Process 6050 attached ./strace-static-x86_64: Process 6049 attached [pid 6048] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6039] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 6050 [pid 6050] set_robust_list(0x5555612166a0, 24 [pid 6049] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6048] <... rseq resumed>) = 0 [pid 6050] <... set_robust_list resumed>) = 0 [pid 6049] <... rseq resumed>) = 0 [pid 6048] set_robust_list(0x7f476942f9a0, 24 [pid 6039] <... futex resumed>) = 0 [pid 6050] chdir("./18" [pid 6049] set_robust_list(0x7f476940e9a0, 24 [pid 6048] <... set_robust_list resumed>) = 0 [pid 6039] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6049] <... set_robust_list resumed>) = 0 [pid 6048] rt_sigprocmask(SIG_SETMASK, [], [pid 6049] rt_sigprocmask(SIG_SETMASK, [], [pid 6048] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6049] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6048] memfd_create("syzkaller", 0 [pid 6050] <... chdir resumed>) = 0 [pid 6049] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 6048] <... memfd_create resumed>) = 3 [ 109.415949][ T6044] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6050] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6048] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6041] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6048] <... mmap resumed>) = 0x7f4761000000 [pid 6041] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6049] <... ioctl resumed>) = 0 [pid 6050] <... prctl resumed>) = 0 [pid 6050] setpgid(0, 0 [pid 6039] <... futex resumed>) = ? [pid 6050] <... setpgid resumed>) = 0 [pid 6050] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6049] +++ killed by SIGSEGV +++ [pid 6050] write(3, "1000", 4 [pid 6041] +++ killed by SIGSEGV +++ [pid 6039] +++ killed by SIGSEGV +++ [pid 6050] <... write resumed>) = 4 [pid 6050] close(3 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6039, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=6 /* 0.06 s */} --- [pid 5833] restart_syscall(<... resuming interrupted clone ...> [pid 6050] <... close resumed>) = 0 [pid 6050] symlink("/dev/binderfs", "./binderfs") = 0 executing program [pid 6050] write(1, "executing program\n", 18) = 18 [pid 6050] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6050] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 6050] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5833] <... restart_syscall resumed>) = 0 [pid 6048] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6050] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6050] <... mmap resumed>) = 0x7f476940f000 [pid 6048] <... write resumed>) = 131072 [pid 6050] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6050] <... mprotect resumed>) = 0 [pid 6044] <... mount resumed>) = 0 [pid 5833] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6050] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5833] <... openat resumed>) = 3 [pid 5833] newfstatat(3, "", [pid 6048] munmap(0x7f4761000000, 138412032) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6050] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6044] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6050] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6044] <... openat resumed>) = 3 ./strace-static-x86_64: Process 6051 attached [pid 6044] chdir("./file1" [pid 6050] <... clone3 resumed> => {parent_tid=[6051]}, 88) = 6051 [pid 6044] <... chdir resumed>) = 0 [pid 6051] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6050] rt_sigprocmask(SIG_SETMASK, [], [pid 6044] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6051] <... rseq resumed>) = 0 [pid 6050] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6048] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 6044] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6051] set_robust_list(0x7f476942f9a0, 24 [pid 6050] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6048] <... openat resumed>) = 4 [pid 6044] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] getdents64(3, [pid 6051] <... set_robust_list resumed>) = 0 [pid 6050] <... futex resumed>) = 0 [pid 6048] ioctl(4, LOOP_SET_FD, 3 [pid 6044] <... futex resumed>) = 1 [pid 6043] <... futex resumed>) = 0 [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6051] rt_sigprocmask(SIG_SETMASK, [], [pid 6050] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6048] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 6044] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6043] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6051] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6048] ioctl(4, LOOP_CLR_FD [pid 6043] <... futex resumed>) = 0 [pid 6051] memfd_create("syzkaller", 0 [pid 6048] <... ioctl resumed>) = 0 [pid 6044] <... openat resumed>) = 4 [pid 6043] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6051] <... memfd_create resumed>) = 3 [pid 6044] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6043] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5833] <... umount2 resumed>) = 0 [pid 6051] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6044] <... futex resumed>) = 0 [pid 6043] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6051] <... mmap resumed>) = 0x7f4761000000 [pid 6048] ioctl(4, LOOP_SET_FD, 3 [pid 5833] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6051] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6048] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 6044] mkdir("./file2", 0777 [pid 6043] <... futex resumed>) = 0 [ 109.540414][ T6046] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6051] <... write resumed>) = 131072 [pid 6048] close(4 [pid 6043] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] newfstatat(AT_FDCWD, "./17/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6051] munmap(0x7f4761000000, 138412032 [pid 6048] <... close resumed>) = 0 [pid 5833] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5833] openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 6051] <... munmap resumed>) = 0 [pid 6048] close(3 [pid 6051] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5833] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] getdents64(4, 0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5833] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6051] <... openat resumed>) = 4 [pid 6048] <... close resumed>) = 0 [pid 5833] close(4) = 0 [pid 5833] rmdir("./17/file1" [pid 6051] ioctl(4, LOOP_SET_FD, 3 [pid 6048] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... rmdir resumed>) = 0 [pid 6048] <... futex resumed>) = 1 [pid 6047] <... futex resumed>) = 0 [ 109.594042][ T6044] exFAT-fs (loop3): error, data size is invalid(9000) [pid 5833] umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6048] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6047] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6046] <... mount resumed>) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6047] <... futex resumed>) = 0 [pid 5833] newfstatat(AT_FDCWD, "./17/binderfs", [pid 6047] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6048] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6046] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5833] unlink("./17/binderfs") = 0 [pid 5833] getdents64(3, [pid 6048] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6046] <... openat resumed>) = 3 [pid 5833] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5833] close(3) = 0 [pid 5833] rmdir("./17") = 0 [pid 5833] mkdir("./18", 0777) = 0 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 5833] ioctl(3, LOOP_CLR_FD) = 0 [pid 5833] close(3) = 0 [pid 6046] chdir("./file1" [pid 6043] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6048] <... openat resumed>) = 3 [pid 6046] <... chdir resumed>) = 0 [pid 6043] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 6052 attached [pid 6048] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6046] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 6043] <... futex resumed>) = 0 [pid 6043] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 6052 [pid 6046] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6043] <... mmap resumed>) = 0x7f47693ee000 [pid 6043] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 6046] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6043] <... mprotect resumed>) = 0 [pid 6044] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6043] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6043] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0}./strace-static-x86_64: Process 6053 attached => {parent_tid=[6053]}, 88) = 6053 [pid 6043] rt_sigprocmask(SIG_SETMASK, [], [pid 6044] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6043] <... rt_sigprocmask resumed>) = ? [pid 6052] set_robust_list(0x5555612166a0, 24 [pid 6053] +++ killed by SIGSEGV +++ [pid 6052] <... set_robust_list resumed>) = 0 [pid 6044] +++ killed by SIGSEGV +++ [pid 6043] +++ killed by SIGSEGV +++ [pid 6052] chdir("./18" [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6043, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 6052] <... chdir resumed>) = 0 [pid 5832] restart_syscall(<... resuming interrupted clone ...> [pid 6052] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6052] setpgid(0, 0) = 0 [pid 6052] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6048] <... futex resumed>) = 1 [pid 6047] <... futex resumed>) = 0 [pid 6046] <... futex resumed>) = 1 [pid 6045] <... futex resumed>) = 0 [pid 5832] <... restart_syscall resumed>) = 0 [pid 6048] mkdir("./file2", 0777 [pid 6047] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6045] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6047] <... futex resumed>) = 0 [pid 6045] <... futex resumed>) = 0 [pid 6048] <... mkdir resumed>) = 0 [pid 6047] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6045] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6046] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6052] <... openat resumed>) = 3 [pid 6048] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6052] write(3, "1000", 4 [pid 5832] <... openat resumed>) = 3 [pid 6052] <... write resumed>) = 4 [pid 6047] <... futex resumed>) = ? [pid 5832] newfstatat(3, "", [pid 6052] close(3 [pid 6051] <... ioctl resumed>) = 0 [pid 6048] +++ killed by SIGSEGV +++ [pid 6047] +++ killed by SIGSEGV +++ [pid 6046] <... openat resumed>) = 4 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6051] close(3 [pid 6046] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] getdents64(3, [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6047, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 6046] <... futex resumed>) = 1 [pid 6051] <... close resumed>) = 0 [pid 6046] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6045] <... futex resumed>) = 0 [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6045] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [ 109.635226][ T6044] exFAT-fs (loop3): Filesystem has been set read-only [ 109.654386][ T6051] loop2: detected capacity change from 0 to 256 [pid 5832] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6045] <... futex resumed>) = 0 [pid 5829] umount2("./16", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6052] <... close resumed>) = 0 [pid 6045] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6052] symlink("/dev/binderfs", "./binderfs" [pid 5829] openat(AT_FDCWD, "./16", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6052] <... symlink resumed>) = 0 [pid 6051] close(4 [pid 6046] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5829] <... openat resumed>) = 3 [pid 6051] <... close resumed>) = 0 executing program [pid 6046] mkdir("./file2", 0777 [pid 5829] newfstatat(3, "", [pid 6051] mkdir("./file1", 0777 [pid 6052] write(1, "executing program\n", 18 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6052] <... write resumed>) = 18 [pid 5829] getdents64(3, [pid 6052] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... getdents64 resumed>0x555561217730 /* 5 entries */, 32768) = 144 [pid 6052] <... futex resumed>) = 0 [pid 5829] umount2("./16/devices.list", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6052] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6052] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5829] newfstatat(AT_FDCWD, "./16/devices.list", [pid 6052] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5829] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6052] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5829] unlink("./16/devices.list" [pid 6052] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5829] <... unlink resumed>) = 0 [pid 6052] <... mmap resumed>) = 0x7f476940f000 [pid 5829] umount2("./16/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6052] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6052] <... mprotect resumed>) = 0 [pid 5829] newfstatat(AT_FDCWD, "./16/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] unlink("./16/binderfs" [pid 6052] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6051] <... mkdir resumed>) = 0 [pid 6052] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] <... umount2 resumed>) = 0 [pid 6052] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5832] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... unlink resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6052] <... clone3 resumed> => {parent_tid=[6054]}, 88) = 6054 [pid 5832] newfstatat(AT_FDCWD, "./17/file1", [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6052] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] newfstatat(AT_FDCWD, "./16/file2", [pid 6051] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 6052] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6052] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] umount2("./16/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6052] <... futex resumed>) = 0 [pid 5832] openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 6054 attached [pid 6052] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5832] <... openat resumed>) = 4 [pid 5829] openat(AT_FDCWD, "./16/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5832] newfstatat(4, "", [pid 5829] <... openat resumed>) = 4 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] newfstatat(4, "", [pid 5832] getdents64(4, [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6054] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] getdents64(4, [pid 5832] getdents64(4, [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] getdents64(4, [pid 6054] <... rseq resumed>) = 0 [pid 5832] close(4 [pid 6054] set_robust_list(0x7f476942f9a0, 24 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6054] <... set_robust_list resumed>) = 0 [pid 5832] <... close resumed>) = 0 [pid 6054] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] rmdir("./17/file1" [pid 5829] close(4 [pid 6054] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6045] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5832] <... rmdir resumed>) = 0 [pid 6054] memfd_create("syzkaller", 0 [pid 6045] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... close resumed>) = 0 [pid 6045] <... futex resumed>) = 0 [pid 5829] rmdir("./16/file2" [pid 6054] <... memfd_create resumed>) = 3 [pid 6045] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5832] umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] <... rmdir resumed>) = 0 [pid 6054] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6045] <... mmap resumed>) = 0x7f47693ee000 [pid 5829] getdents64(3, [pid 6054] <... mmap resumed>) = 0x7f4761000000 [ 109.717817][ T6046] exFAT-fs (loop1): error, data size is invalid(9000) [ 109.748106][ T6046] exFAT-fs (loop1): Filesystem has been set read-only [pid 6045] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6054] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6045] <... mprotect resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] close(3 [pid 6045] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] newfstatat(AT_FDCWD, "./17/binderfs", [pid 5829] <... close resumed>) = 0 [pid 6045] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] rmdir("./16" [pid 6054] <... write resumed>) = 131072 [pid 6045] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5832] unlink("./17/binderfs" [pid 6045] <... clone3 resumed> => {parent_tid=[6055]}, 88) = 6055 [pid 6045] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 6055 attached NULL, 8) = 0 [pid 5832] <... unlink resumed>) = 0 [pid 5829] <... rmdir resumed>) = 0 [pid 6055] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6045] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6055] <... rseq resumed>) = 0 [pid 6054] munmap(0x7f4761000000, 138412032 [pid 6045] <... futex resumed>) = 0 [pid 6055] set_robust_list(0x7f476940e9a0, 24 [pid 6054] <... munmap resumed>) = 0 [pid 6045] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6055] <... set_robust_list resumed>) = 0 [pid 6054] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 6055] rt_sigprocmask(SIG_SETMASK, [], [pid 6054] <... openat resumed>) = 4 [pid 6055] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6054] ioctl(4, LOOP_SET_FD, 3 [pid 6055] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 5832] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] mkdir("./17", 0777 [pid 5832] close(3 [pid 5829] <... mkdir resumed>) = 0 [pid 5832] <... close resumed>) = 0 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5832] rmdir("./17" [pid 5829] <... openat resumed>) = 3 [pid 6055] <... ioctl resumed>) = 0 [pid 5832] <... rmdir resumed>) = 0 [pid 5829] ioctl(3, LOOP_CLR_FD [pid 6046] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6055] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] mkdir("./18", 0777 [pid 5829] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 6055] <... futex resumed>) = 1 [pid 5832] <... mkdir resumed>) = 0 [pid 5829] close(3 [pid 6055] futex(0x7f47695046d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5829] <... close resumed>) = 0 [pid 5832] <... openat resumed>) = 3 [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6045] <... futex resumed>) = 0 [pid 5832] ioctl(3, LOOP_CLR_FD) = 0 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 6056 [pid 5832] close(3./strace-static-x86_64: Process 6056 attached ) = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6046] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6056] set_robust_list(0x5555612166a0, 24./strace-static-x86_64: Process 6057 attached ) = 0 executing program [pid 6056] chdir("./17") = 0 [pid 6056] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6056] setpgid(0, 0) = 0 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 6057 [pid 6056] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6057] set_robust_list(0x5555612166a0, 24 [pid 6056] write(3, "1000", 4 [pid 6057] <... set_robust_list resumed>) = 0 [pid 6056] <... write resumed>) = 4 [pid 6057] chdir("./18" [pid 6056] close(3) = 0 [pid 6056] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6056] write(1, "executing program\n", 18 [pid 6057] <... chdir resumed>) = 0 [pid 6056] <... write resumed>) = 18 [pid 6057] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6056] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6057] <... prctl resumed>) = 0 [ 109.780124][ T6051] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 109.794426][ T6054] loop4: detected capacity change from 0 to 256 [pid 6057] setpgid(0, 0 [pid 6056] <... futex resumed>) = 0 [pid 6054] <... ioctl resumed>) = 0 [pid 6056] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6054] close(3 [pid 6057] <... setpgid resumed>) = 0 [pid 6056] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6054] <... close resumed>) = 0 [pid 6057] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6056] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6054] close(4 [pid 6056] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6055] <... futex resumed>) = ? [pid 6057] <... openat resumed>) = 3 [pid 6056] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6055] +++ killed by SIGSEGV +++ [pid 6054] <... close resumed>) = 0 [pid 6057] write(3, "1000", 4 [pid 6056] <... mmap resumed>) = 0x7f476940f000 [pid 6054] mkdir("./file1", 0777 [pid 6057] <... write resumed>) = 4 [pid 6056] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6054] <... mkdir resumed>) = 0 [pid 6046] +++ killed by SIGSEGV +++ [pid 6045] +++ killed by SIGSEGV +++ [pid 6057] close(3 [pid 6056] <... mprotect resumed>) = 0 [pid 6054] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6045, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 6057] <... close resumed>) = 0 [pid 6056] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6051] <... mount resumed>) = 0 [pid 5830] restart_syscall(<... resuming interrupted clone ...> [pid 6057] symlink("/dev/binderfs", "./binderfs" [pid 6056] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6057] <... symlink resumed>) = 0 [pid 6056] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 6058 attached [pid 6057] write(1, "executing program\n", 18executing program [pid 6058] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6057] <... write resumed>) = 18 [pid 6056] <... clone3 resumed> => {parent_tid=[6058]}, 88) = 6058 [pid 6058] <... rseq resumed>) = 0 [pid 6057] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6056] rt_sigprocmask(SIG_SETMASK, [], [pid 6058] set_robust_list(0x7f476942f9a0, 24 [pid 6057] <... futex resumed>) = 0 [pid 6056] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6058] <... set_robust_list resumed>) = 0 [pid 6057] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6056] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6058] rt_sigprocmask(SIG_SETMASK, [], [pid 6057] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6056] <... futex resumed>) = 0 [pid 6058] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6057] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6056] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6058] memfd_create("syzkaller", 0 [pid 6057] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6051] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5830] <... restart_syscall resumed>) = 0 [pid 6058] <... memfd_create resumed>) = 3 [pid 6057] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6058] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6057] <... mmap resumed>) = 0x7f476940f000 [pid 6051] <... openat resumed>) = 3 [pid 6058] <... mmap resumed>) = 0x7f4761000000 [pid 6057] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6051] chdir("./file1" [pid 6057] <... mprotect resumed>) = 0 [pid 6051] <... chdir resumed>) = 0 [pid 6057] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5830] umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6057] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6057] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 6059 attached [pid 6059] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6058] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6057] <... clone3 resumed> => {parent_tid=[6059]}, 88) = 6059 [pid 5830] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6057] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6059] <... rseq resumed>) = 0 [pid 6058] <... write resumed>) = 131072 [pid 6057] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... openat resumed>) = 3 [pid 6059] set_robust_list(0x7f476942f9a0, 24 [pid 6058] munmap(0x7f4761000000, 138412032 [pid 6057] <... futex resumed>) = 0 [pid 6051] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5830] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] getdents64(3, [pid 6051] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6058] <... munmap resumed>) = 0 [pid 6057] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6051] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6059] <... set_robust_list resumed>) = 0 [pid 6051] <... futex resumed>) = 1 [pid 5830] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6059] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6050] <... futex resumed>) = 0 [pid 6051] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6059] memfd_create("syzkaller", 0 [pid 6050] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6059] <... memfd_create resumed>) = 3 [pid 6050] <... futex resumed>) = 0 [pid 6059] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6050] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6059] <... mmap resumed>) = 0x7f4761000000 [pid 6058] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 6059] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6058] <... openat resumed>) = 4 [pid 6051] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 5830] <... umount2 resumed>) = 0 [pid 6058] ioctl(4, LOOP_SET_FD, 3 [pid 6051] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5830] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6059] <... write resumed>) = 131072 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6051] <... openat resumed>) = 4 [ 109.917623][ T6058] loop0: detected capacity change from 0 to 256 [ 109.926070][ T6054] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6059] munmap(0x7f4761000000, 138412032 [pid 6051] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] newfstatat(AT_FDCWD, "./17/file1", [pid 6059] <... munmap resumed>) = 0 [pid 6051] <... futex resumed>) = 1 [pid 6050] <... futex resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6050] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6051] mkdir("./file2", 0777 [pid 6050] <... futex resumed>) = 0 [pid 6050] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6059] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6058] <... ioctl resumed>) = 0 [pid 6058] close(3) = 0 [pid 6058] close(4) = 0 [pid 6058] mkdir("./file1", 0777) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6058] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5830] openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5830] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6054] <... mount resumed>) = 0 [pid 6059] <... openat resumed>) = 4 [pid 5830] getdents64(4, [pid 6059] ioctl(4, LOOP_SET_FD, 3 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6051] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5830] getdents64(4, [pid 6051] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6050] <... futex resumed>) = ? [pid 5830] close(4 [pid 6054] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5830] <... close resumed>) = 0 [ 109.968584][ T6051] exFAT-fs (loop2): error, data size is invalid(9000) [ 109.993381][ T6051] exFAT-fs (loop2): Filesystem has been set read-only [ 109.995545][ T6059] loop3: detected capacity change from 0 to 256 [pid 6054] <... openat resumed>) = 3 [pid 6051] +++ killed by SIGSEGV +++ [pid 6050] +++ killed by SIGSEGV +++ [pid 5830] rmdir("./17/file1" [pid 6054] chdir("./file1" [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6050, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5830] <... rmdir resumed>) = 0 [pid 6054] <... chdir resumed>) = 0 [pid 5830] umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6054] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6054] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5830] newfstatat(AT_FDCWD, "./17/binderfs", [pid 6054] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6052] <... futex resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6052] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6054] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5830] unlink("./17/binderfs" [pid 6052] <... futex resumed>) = 0 [pid 6052] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5831] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5831] newfstatat(3, "", [pid 5830] <... unlink resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5831] getdents64(3, [pid 6054] <... openat resumed>) = 4 [pid 5830] getdents64(3, [pid 6054] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6054] <... futex resumed>) = 1 [pid 5830] close(3 [pid 6052] <... futex resumed>) = 0 [pid 5830] <... close resumed>) = 0 [pid 6054] mkdir("./file2", 0777 [pid 6052] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] rmdir("./17") = 0 [pid 6059] <... ioctl resumed>) = 0 [pid 6052] <... futex resumed>) = 0 [pid 5831] <... umount2 resumed>) = 0 [pid 5830] mkdir("./18", 0777 [pid 6052] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... mkdir resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5831] newfstatat(AT_FDCWD, "./18/file1", [pid 5830] <... openat resumed>) = 3 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5831] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... ioctl resumed>) = 0 [pid 6059] close(3 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] close(3 [pid 6059] <... close resumed>) = 0 [pid 6059] close(4 [pid 6058] <... mount resumed>) = 0 [ 110.055827][ T6058] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 110.092634][ T6054] exFAT-fs (loop4): error, data size is invalid(9000) [pid 5831] openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5830] <... close resumed>) = 0 [pid 6059] <... close resumed>) = 0 [pid 6058] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5831] <... openat resumed>) = 4 [pid 6059] mkdir("./file1", 0777 [pid 6058] <... openat resumed>) = 3 [pid 6054] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6058] chdir("./file1") = 0 [pid 5831] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6059] <... mkdir resumed>) = 0 [pid 6058] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 6059] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 6054] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6058] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5831] getdents64(4, [pid 6058] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6052] <... futex resumed>) = ? [pid 6058] <... futex resumed>) = 1 [pid 6054] +++ killed by SIGSEGV +++ [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5831] close(4) = 0 [pid 5831] rmdir("./18/file1" [pid 6058] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6056] <... futex resumed>) = 0 [pid 6052] +++ killed by SIGSEGV +++ [pid 5831] <... rmdir resumed>) = 0 [pid 6058] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6056] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6058] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6056] <... futex resumed>) = 0 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6052, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- ./strace-static-x86_64: Process 6060 attached [pid 5831] umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 6060 [pid 5833] umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6060] set_robust_list(0x5555612166a0, 24 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 110.143208][ T6054] exFAT-fs (loop4): Filesystem has been set read-only [pid 5831] newfstatat(AT_FDCWD, "./18/binderfs", [pid 6060] <... set_robust_list resumed>) = 0 [pid 6058] <... openat resumed>) = 4 [pid 6056] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6060] chdir("./18") = 0 [pid 5831] unlink("./18/binderfs" [pid 6060] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5831] <... unlink resumed>) = 0 [pid 5833] <... openat resumed>) = 3 [pid 6060] <... prctl resumed>) = 0 [pid 5831] getdents64(3, [ 110.187990][ T6059] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6060] setpgid(0, 0 [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6060] <... setpgid resumed>) = 0 [pid 6058] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] newfstatat(3, "", [pid 6060] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6058] <... futex resumed>) = 1 [pid 6056] <... futex resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6058] mkdir("./file2", 0777 [pid 6056] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] getdents64(3, [pid 6060] <... openat resumed>) = 3 [pid 6056] <... futex resumed>) = 0 [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5831] close(3 [pid 6060] write(3, "1000", 4 [pid 5831] <... close resumed>) = 0 [pid 6060] <... write resumed>) = 4 [pid 5831] rmdir("./18") = 0 [pid 6060] close(3 [pid 6056] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] mkdir("./19", 0777 [pid 6060] <... close resumed>) = 0 [pid 5831] <... mkdir resumed>) = 0 [pid 6060] symlink("/dev/binderfs", "./binderfs" [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6060] <... symlink resumed>) = 0 [pid 5833] <... umount2 resumed>) = 0 [pid 5831] <... openat resumed>) = 3 [pid 5833] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOWexecuting program [pid 6060] write(1, "executing program\n", 18 [pid 5831] ioctl(3, LOOP_CLR_FD [pid 6060] <... write resumed>) = 18 [pid 5831] <... ioctl resumed>) = 0 [pid 6060] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] close(3 [pid 6060] <... futex resumed>) = 0 [pid 5831] <... close resumed>) = 0 [pid 6060] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6059] <... mount resumed>) = 0 ./strace-static-x86_64: Process 6061 attached [pid 6060] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6059] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6060] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 6061 [pid 6061] set_robust_list(0x5555612166a0, 24 [pid 6059] <... openat resumed>) = 3 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] newfstatat(AT_FDCWD, "./18/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6060] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 6060] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6060] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5833] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6060] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}./strace-static-x86_64: Process 6062 attached [pid 6061] <... set_robust_list resumed>) = 0 [pid 6059] chdir("./file1" [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6060] <... clone3 resumed> => {parent_tid=[6062]}, 88) = 6062 [pid 6056] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 6062] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6061] chdir("./19" [pid 6060] rt_sigprocmask(SIG_SETMASK, [], [pid 6059] <... chdir resumed>) = 0 [pid 6056] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6062] <... rseq resumed>) = 0 [pid 6059] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6056] <... futex resumed>) = 0 [pid 6062] set_robust_list(0x7f476942f9a0, 24 [pid 6061] <... chdir resumed>) = 0 [pid 6060] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6059] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6056] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] <... openat resumed>) = 4 [pid 6062] <... set_robust_list resumed>) = 0 [pid 6056] <... mmap resumed>) = 0x7f47693ee000 [pid 6062] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] newfstatat(4, "", [pid 6060] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6056] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6062] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] getdents64(4, [pid 6062] memfd_create("syzkaller", 0 [pid 6060] <... futex resumed>) = 0 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6062] <... memfd_create resumed>) = 3 [pid 6060] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6056] <... mprotect resumed>) = 0 [pid 5833] getdents64(4, [pid 6062] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6061] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6059] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6058] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6056] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [ 110.234870][ T6058] exFAT-fs (loop0): error, data size is invalid(9000) [ 110.274653][ T6058] exFAT-fs (loop0): Filesystem has been set read-only [pid 6062] <... mmap resumed>) = 0x7f4761000000 [pid 6061] <... prctl resumed>) = 0 [pid 6059] <... futex resumed>) = 1 [pid 6058] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6057] <... futex resumed>) = 0 [pid 6056] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5833] close(4 [pid 6059] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6057] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6062] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6061] setpgid(0, 0 [pid 6059] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6058] +++ killed by SIGSEGV +++ [pid 6057] <... futex resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 6057] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6061] <... setpgid resumed>) = 0 [pid 6059] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6056] +++ killed by SIGSEGV +++ [pid 5833] rmdir("./18/file1" [pid 6062] <... write resumed>) = 131072 [pid 6061] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6059] <... openat resumed>) = 4 [pid 5833] <... rmdir resumed>) = 0 [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6056, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5833] umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6062] munmap(0x7f4761000000, 138412032 [pid 6059] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6057] <... futex resumed>) = 0 [pid 6062] <... munmap resumed>) = 0 [pid 6059] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6062] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 6059] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6057] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] umount2("./17", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6062] <... openat resumed>) = 4 [pid 6059] mkdir("./file2", 0777 [pid 6057] <... futex resumed>) = 0 [pid 5833] newfstatat(AT_FDCWD, "./18/binderfs", [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6062] ioctl(4, LOOP_SET_FD, 3 [pid 6061] <... openat resumed>) = 3 [pid 5829] openat(AT_FDCWD, "./17", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 6062] <... ioctl resumed>) = 0 [pid 6061] write(3, "1000", 4 [pid 6057] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] newfstatat(3, "", [pid 6062] close(3 [pid 6061] <... write resumed>) = 4 [pid 5833] unlink("./18/binderfs" [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 110.356129][ T6059] exFAT-fs (loop3): error, data size is invalid(9000) [ 110.368960][ T6062] loop1: detected capacity change from 0 to 256 [pid 6062] <... close resumed>) = 0 [pid 6061] close(3 [pid 5833] <... unlink resumed>) = 0 [pid 5829] getdents64(3, [pid 6061] <... close resumed>) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6062] close(4 [pid 6061] symlink("/dev/binderfs", "./binderfs" [pid 5833] getdents64(3, [pid 5829] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6061] <... symlink resumed>) = 0 [pid 5833] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] <... umount2 resumed>) = 0 [pid 5833] close(3executing program [pid 6062] <... close resumed>) = 0 [pid 6061] write(1, "executing program\n", 18 [pid 5833] <... close resumed>) = 0 [pid 5829] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5829] newfstatat(AT_FDCWD, "./17/file1", [pid 5833] rmdir("./18" [pid 6062] mkdir("./file1", 0777 [pid 6061] <... write resumed>) = 18 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6062] <... mkdir resumed>) = 0 [pid 6061] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... rmdir resumed>) = 0 [pid 5829] umount2("./17/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6057] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5833] mkdir("./19", 0777 [pid 6057] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6062] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 6061] <... futex resumed>) = 0 [pid 6057] <... futex resumed>) = 0 [pid 5833] <... mkdir resumed>) = 0 [pid 5829] openat(AT_FDCWD, "./17/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6061] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6057] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 6061] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6059] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6057] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 6061] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5829] <... openat resumed>) = 4 [ 110.405550][ T6059] exFAT-fs (loop3): Filesystem has been set read-only [pid 6059] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6061] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6057] <... mprotect resumed>) = 0 [pid 5833] <... openat resumed>) = 3 [pid 5829] newfstatat(4, "", [pid 6061] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6057] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6061] <... mmap resumed>) = 0x7f476940f000 [pid 6057] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5829] getdents64(4, [pid 6061] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6057] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5833] <... ioctl resumed>) = 0 [pid 6061] <... mprotect resumed>) = 0 [pid 5833] close(3 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 ./strace-static-x86_64: Process 6063 attached [pid 6061] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5833] <... close resumed>) = 0 [pid 5829] getdents64(4, [pid 6063] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6057] <... clone3 resumed> => {parent_tid=[6063]}, 88) = 6063 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] close(4./strace-static-x86_64: Process 6064 attached [pid 6063] <... rseq resumed>) = ? [pid 6061] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5829] <... close resumed>) = 0 [pid 6064] set_robust_list(0x5555612166a0, 24 [pid 6061] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6064] <... set_robust_list resumed>) = 0 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 6064 [pid 5829] rmdir("./17/file1" [pid 6063] +++ killed by SIGSEGV +++ ./strace-static-x86_64: Process 6065 attached [pid 6064] chdir("./19" [pid 5829] <... rmdir resumed>) = 0 [ 110.480616][ T6062] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5829] umount2("./17/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6065] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6064] <... chdir resumed>) = 0 [pid 6061] <... clone3 resumed> => {parent_tid=[6065]}, 88) = 6065 [pid 6059] +++ killed by SIGSEGV +++ [pid 6057] +++ killed by SIGSEGV +++ [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6057, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=9 /* 0.09 s */} --- [pid 6061] rt_sigprocmask(SIG_SETMASK, [], [pid 5829] newfstatat(AT_FDCWD, "./17/binderfs", [pid 6065] <... rseq resumed>) = 0 [pid 6064] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6061] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] unlink("./17/binderfs" [pid 6061] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6065] set_robust_list(0x7f476942f9a0, 24 [pid 6064] <... prctl resumed>) = 0 [pid 6061] <... futex resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... unlink resumed>) = 0 [pid 6061] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 5832] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] getdents64(3, [pid 6065] <... set_robust_list resumed>) = 0 [pid 6064] setpgid(0, 0 [pid 5832] <... openat resumed>) = 3 [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6065] rt_sigprocmask(SIG_SETMASK, [], [pid 6064] <... setpgid resumed>) = 0 [pid 5832] newfstatat(3, "", [pid 5829] close(3 [pid 6065] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6064] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] <... close resumed>) = 0 [pid 5832] getdents64(3, [pid 5829] rmdir("./17" [pid 6064] <... openat resumed>) = 3 [pid 6062] <... mount resumed>) = 0 [pid 6065] memfd_create("syzkaller", 0 [pid 6064] write(3, "1000", 4 [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5829] <... rmdir resumed>) = 0 [pid 6065] <... memfd_create resumed>) = 3 [pid 6064] <... write resumed>) = 4 [pid 5832] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] mkdir("./18", 0777 [pid 6064] close(3 [pid 6065] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6064] <... close resumed>) = 0 [pid 6062] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5829] <... mkdir resumed>) = 0 [pid 6064] symlink("/dev/binderfs", "./binderfs" [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 6065] <... mmap resumed>) = 0x7f4761000000 [pid 6064] <... symlink resumed>) = 0 [pid 6062] <... openat resumed>) = 3 [pid 5829] ioctl(3, LOOP_CLR_FD executing program [pid 6064] write(1, "executing program\n", 18 [pid 5829] <... ioctl resumed>) = 0 [pid 6065] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6064] <... write resumed>) = 18 [pid 5829] close(3 [pid 6064] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... close resumed>) = 0 [pid 6062] chdir("./file1" [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6062] <... chdir resumed>) = 0 ./strace-static-x86_64: Process 6066 attached [pid 6065] <... write resumed>) = 131072 [pid 6064] <... futex resumed>) = 0 [pid 6062] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 6066] set_robust_list(0x5555612166a0, 24 [pid 6065] munmap(0x7f4761000000, 138412032 [pid 6064] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6062] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5832] <... umount2 resumed>) = 0 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 6066 [pid 6066] <... set_robust_list resumed>) = 0 [pid 6065] <... munmap resumed>) = 0 [pid 6064] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6062] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6066] chdir("./18" [pid 6064] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6062] <... futex resumed>) = 1 [pid 6060] <... futex resumed>) = 0 [pid 6066] <... chdir resumed>) = 0 [pid 6065] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6064] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6066] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6065] <... openat resumed>) = 4 [pid 6064] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6060] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6066] <... prctl resumed>) = 0 [pid 6062] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6064] <... mmap resumed>) = 0x7f476940f000 [pid 6066] setpgid(0, 0) = 0 [pid 6065] ioctl(4, LOOP_SET_FD, 3 [pid 6066] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6060] <... futex resumed>) = 0 [pid 6060] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6064] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6066] <... openat resumed>) = 3 [pid 6064] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6062] <... openat resumed>) = 4 [pid 5832] newfstatat(AT_FDCWD, "./18/file1", [pid 6064] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6066] write(3, "1000", 4 [pid 6064] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6062] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 6067 attached [pid 6066] <... write resumed>) = 4 [pid 6062] <... futex resumed>) = 1 [pid 6060] <... futex resumed>) = 0 [pid 5832] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6067] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6066] close(3 [pid 6064] <... clone3 resumed> => {parent_tid=[6067]}, 88) = 6067 [pid 6062] mkdir("./file2", 0777 [pid 6060] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6067] <... rseq resumed>) = 0 [pid 6066] <... close resumed>) = 0 [pid 6064] rt_sigprocmask(SIG_SETMASK, [], [pid 6067] set_robust_list(0x7f476942f9a0, 24 [pid 6066] symlink("/dev/binderfs", "./binderfs" [pid 6064] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6060] <... futex resumed>) = 0 [pid 5832] openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6067] <... set_robust_list resumed>) = 0 [pid 6066] <... symlink resumed>) = 0 [pid 6064] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6067] rt_sigprocmask(SIG_SETMASK, [], [pid 6064] <... futex resumed>) = 0 executing program [pid 6067] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6066] write(1, "executing program\n", 18 [pid 6064] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6067] memfd_create("syzkaller", 0) = 3 [pid 6066] <... write resumed>) = 18 [pid 6067] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 6067] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6066] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6066] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 6066] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6066] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 6066] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6060] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] <... openat resumed>) = 4 [pid 6066] <... mprotect resumed>) = 0 [pid 5832] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] getdents64(4, [pid 6066] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6066] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 ./strace-static-x86_64: Process 6068 attached [pid 5832] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5832] close(4 [pid 6067] <... write resumed>) = 131072 [pid 5832] <... close resumed>) = 0 [pid 5832] rmdir("./18/file1" [pid 6068] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6067] munmap(0x7f4761000000, 138412032) = 0 [pid 6066] <... clone3 resumed> => {parent_tid=[6068]}, 88) = 6068 [pid 6068] <... rseq resumed>) = 0 [pid 6067] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 6066] rt_sigprocmask(SIG_SETMASK, [], [pid 6068] set_robust_list(0x7f476942f9a0, 24 [pid 6067] <... openat resumed>) = 4 [pid 6066] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 110.670947][ T6062] exFAT-fs (loop1): error, data size is invalid(9000) [ 110.695125][ T6065] loop2: detected capacity change from 0 to 256 [ 110.696480][ T6062] exFAT-fs (loop1): Filesystem has been set read-only [pid 6068] <... set_robust_list resumed>) = 0 [pid 6067] ioctl(4, LOOP_SET_FD, 3 [pid 6066] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6068] rt_sigprocmask(SIG_SETMASK, [], [pid 6066] <... futex resumed>) = 0 [pid 6068] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6066] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6068] memfd_create("syzkaller", 0) = 3 [pid 6068] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5832] <... rmdir resumed>) = 0 [pid 6068] <... mmap resumed>) = 0x7f4761000000 [pid 6065] <... ioctl resumed>) = 0 [pid 6065] close(3 [pid 6060] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5832] umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6068] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6065] <... close resumed>) = 0 [pid 6060] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6068] <... write resumed>) = 131072 [pid 6065] close(4 [pid 6060] <... futex resumed>) = 0 [pid 5832] newfstatat(AT_FDCWD, "./18/binderfs", [pid 6068] munmap(0x7f4761000000, 138412032 [pid 6065] <... close resumed>) = 0 [pid 6060] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6068] <... munmap resumed>) = 0 [pid 6065] mkdir("./file1", 0777 [pid 6060] <... mmap resumed>) = 0x7f47693ee000 [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6065] <... mkdir resumed>) = 0 [ 110.716925][ T6067] loop4: detected capacity change from 0 to 256 [pid 6060] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 6068] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 6067] <... ioctl resumed>) = 0 [pid 6065] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 6062] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5832] unlink("./18/binderfs" [pid 6060] <... mprotect resumed>) = 0 [pid 6068] <... openat resumed>) = 4 [pid 6067] close(3 [pid 6060] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6068] ioctl(4, LOOP_SET_FD, 3 [pid 6067] <... close resumed>) = 0 [pid 6067] close(4 [pid 6062] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6060] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] <... unlink resumed>) = 0 [pid 6067] <... close resumed>) = 0 [pid 6067] mkdir("./file1", 0777 [pid 6062] +++ killed by SIGSEGV +++ [pid 5832] getdents64(3, [pid 6067] <... mkdir resumed>) = 0 [pid 6067] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 6060] +++ killed by SIGSEGV +++ [pid 5832] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] close(3 [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6060, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 6068] <... ioctl resumed>) = 0 [pid 5830] restart_syscall(<... resuming interrupted clone ...> [pid 5832] <... close resumed>) = 0 [pid 5832] rmdir("./18" [pid 6068] close(3) = 0 [pid 6068] close(4) = 0 [pid 6068] mkdir("./file1", 0777 [pid 5832] <... rmdir resumed>) = 0 [pid 5832] mkdir("./19", 0777 [pid 5830] <... restart_syscall resumed>) = 0 [pid 6068] <... mkdir resumed>) = 0 [pid 6068] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5830] umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5830] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5832] <... mkdir resumed>) = 0 [pid 5830] <... openat resumed>) = 3 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [ 110.771783][ T6068] loop0: detected capacity change from 0 to 256 [pid 5830] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] <... openat resumed>) = 3 [pid 5830] getdents64(3, [pid 5832] ioctl(3, LOOP_CLR_FD [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5832] <... ioctl resumed>) = 0 [pid 5830] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] close(3) = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5830] <... umount2 resumed>) = 0 [pid 5830] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5830] newfstatat(AT_FDCWD, "./18/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 6069 attached [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 6069 [pid 5830] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5830] openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6069] set_robust_list(0x5555612166a0, 24 [pid 5830] <... openat resumed>) = 4 [pid 6069] <... set_robust_list resumed>) = 0 [pid 6069] chdir("./19" [pid 5830] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6069] <... chdir resumed>) = 0 [pid 6069] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6069] setpgid(0, 0) = 0 [pid 6069] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5830] getdents64(4, [pid 6069] write(3, "1000", 4 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5830] getdents64(4, executing program [pid 6069] <... write resumed>) = 4 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6069] close(3) = 0 [pid 6069] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6069] write(1, "executing program\n", 18) = 18 [pid 6069] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6069] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 6069] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6069] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 6069] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6069] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5830] close(4 [pid 6069] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6069] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} => {parent_tid=[6070]}, 88) = 6070 [ 110.861061][ T6065] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 110.890557][ T6067] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6069] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 6070 attached [pid 6069] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... close resumed>) = 0 [pid 6069] <... futex resumed>) = 0 [pid 5830] rmdir("./18/file1" [pid 6069] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6070] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5830] <... rmdir resumed>) = 0 [pid 6070] <... rseq resumed>) = 0 [pid 6065] <... mount resumed>) = 0 [pid 5830] umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6070] set_robust_list(0x7f476942f9a0, 24 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6070] <... set_robust_list resumed>) = 0 [pid 6070] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6070] memfd_create("syzkaller", 0 [pid 6065] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6067] <... mount resumed>) = 0 [pid 6065] <... openat resumed>) = 3 [pid 5830] newfstatat(AT_FDCWD, "./18/binderfs", [pid 6065] chdir("./file1" [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6065] <... chdir resumed>) = 0 [pid 5830] unlink("./18/binderfs" [pid 6070] <... memfd_create resumed>) = 3 [pid 6067] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6070] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6067] <... openat resumed>) = 3 [pid 6070] <... mmap resumed>) = 0x7f4761000000 [pid 6067] chdir("./file1") = 0 [pid 6065] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6067] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 6065] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6067] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6065] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6067] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6070] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6065] <... futex resumed>) = 1 [pid 6061] <... futex resumed>) = 0 [pid 5830] <... unlink resumed>) = 0 [pid 6070] <... write resumed>) = 131072 [pid 6065] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6061] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] getdents64(3, [pid 6061] <... futex resumed>) = 0 [pid 6061] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6070] munmap(0x7f4761000000, 138412032 [pid 6067] <... futex resumed>) = 1 [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6067] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5830] close(3 [pid 6070] <... munmap resumed>) = 0 [ 110.945315][ T6068] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6070] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 6064] <... futex resumed>) = 0 [pid 6070] ioctl(4, LOOP_SET_FD, 3 [pid 6064] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6067] <... futex resumed>) = 0 [pid 6064] <... futex resumed>) = 1 [pid 5830] <... close resumed>) = 0 [pid 5830] rmdir("./18" [pid 6067] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6064] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] <... rmdir resumed>) = 0 [pid 6068] <... mount resumed>) = 0 [pid 6068] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6067] <... openat resumed>) = 4 [pid 5830] mkdir("./19", 0777 [pid 6068] <... openat resumed>) = 3 [pid 6067] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6068] chdir("./file1" [pid 6067] <... futex resumed>) = 1 [pid 6064] <... futex resumed>) = 0 [pid 6068] <... chdir resumed>) = 0 [pid 6067] mkdir("./file2", 0777 [pid 6064] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... mkdir resumed>) = 0 [pid 6068] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 6065] <... openat resumed>) = 4 [pid 6064] <... futex resumed>) = 0 [pid 6061] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 6070] <... ioctl resumed>) = 0 [pid 6065] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6064] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6061] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... openat resumed>) = 3 [pid 5830] ioctl(3, LOOP_CLR_FD [pid 6070] close(3 [pid 6068] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6065] <... futex resumed>) = 0 [pid 6061] <... futex resumed>) = 0 [pid 5830] <... ioctl resumed>) = 0 [pid 5830] close(3 [pid 6070] <... close resumed>) = 0 [pid 6068] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6065] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6061] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6070] close(4 [pid 6068] <... futex resumed>) = 1 [pid 6066] <... futex resumed>) = 0 [pid 6061] <... mmap resumed>) = 0x7f47693ee000 [pid 6066] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6061] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 6068] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6066] <... futex resumed>) = 0 [pid 6061] <... mprotect resumed>) = 0 [pid 5830] <... close resumed>) = 0 [pid 6066] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6061] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6061] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0}./strace-static-x86_64: Process 6071 attached [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6071] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6061] <... clone3 resumed> => {parent_tid=[6071]}, 88) = 6071 [pid 6070] <... close resumed>) = 0 [pid 6061] rt_sigprocmask(SIG_SETMASK, [], [pid 6070] mkdir("./file1", 0777 [pid 6061] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 6072 attached [pid 6071] <... rseq resumed>) = 0 [pid 6070] <... mkdir resumed>) = 0 [pid 6061] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6061] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6071] set_robust_list(0x7f476940e9a0, 24) = 0 [pid 6068] <... openat resumed>) = 4 [pid 6068] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6066] <... futex resumed>) = 0 [pid 6066] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6071] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6066] <... futex resumed>) = 0 [pid 6071] mkdir("./file2", 0777 [ 111.008683][ T6070] loop3: detected capacity change from 0 to 256 [ 111.033644][ T6067] exFAT-fs (loop4): error, data size is invalid(9000) [ 111.041213][ T6067] exFAT-fs (loop4): Filesystem has been set read-only [pid 6066] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6070] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 6068] mkdir("./file2", 0777 [pid 6064] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 6064] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6064] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 6064] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6072] set_robust_list(0x5555612166a0, 24 [pid 6067] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6066] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 6061] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 6072 [pid 6072] <... set_robust_list resumed>) = 0 [pid 6067] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6066] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6061] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6072] chdir("./19" [pid 6066] <... futex resumed>) = 0 [pid 6065] <... futex resumed>) = 0 [pid 6061] <... futex resumed>) = 1 [pid 6072] <... chdir resumed>) = 0 [pid 6066] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6065] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 6061] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6072] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6066] <... mmap resumed>) = 0x7f47693ee000 [pid 6072] <... prctl resumed>) = 0 [pid 6066] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 6072] setpgid(0, 0 [pid 6066] <... mprotect resumed>) = 0 [pid 6065] <... ioctl resumed>) = 0 [pid 6072] <... setpgid resumed>) = 0 [pid 6066] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6065] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6066] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6072] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6066] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 6065] <... futex resumed>) = 1 [pid 6061] <... futex resumed>) = 0 [pid 6072] <... openat resumed>) = 3 [pid 6065] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 6073 attached [pid 6072] write(3, "1000", 4 [pid 6066] <... clone3 resumed> => {parent_tid=[6073]}, 88) = 6073 [pid 6073] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6072] <... write resumed>) = 4 [pid 6067] +++ killed by SIGSEGV +++ [pid 6072] close(3 [ 111.075311][ T6071] exFAT-fs (loop2): error, data size is invalid(9000) [ 111.076901][ T6068] exFAT-fs (loop0): error, data size is invalid(9000) [ 111.114320][ T6071] exFAT-fs (loop2): Filesystem has been set read-only [pid 6073] <... rseq resumed>) = 0 [pid 6072] <... close resumed>) = 0 [pid 6066] rt_sigprocmask(SIG_SETMASK, [], [pid 6073] set_robust_list(0x7f476940e9a0, 24 [pid 6071] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6066] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6064] +++ killed by SIGSEGV +++ [pid 6072] symlink("/dev/binderfs", "./binderfs" [pid 6073] <... set_robust_list resumed>) = 0 [pid 6066] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6073] rt_sigprocmask(SIG_SETMASK, [], [pid 6072] <... symlink resumed>) = 0 [pid 6066] <... futex resumed>) = 0 [pid 6071] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6073] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6072] write(1, "executing program\n", 18 [pid 6066] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}executing program [pid 6065] <... futex resumed>) = ? [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6064, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 6073] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 6072] <... write resumed>) = 18 [pid 6071] +++ killed by SIGSEGV +++ [pid 6065] +++ killed by SIGSEGV +++ [pid 6061] +++ killed by SIGSEGV +++ [pid 5833] umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6072] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6061, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 6068] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5833] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6072] <... futex resumed>) = 0 [pid 6068] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 111.156574][ T6068] exFAT-fs (loop0): Filesystem has been set read-only [pid 5833] <... openat resumed>) = 3 [pid 5831] restart_syscall(<... resuming interrupted clone ...> [pid 6072] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 5833] newfstatat(3, "", [pid 5831] <... restart_syscall resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 6072] <... rt_sigaction resumed>NULL, 8) = 0 [pid 5833] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6073] <... ioctl resumed>) = ? [pid 6072] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6066] <... futex resumed>) = ? [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6073] +++ killed by SIGSEGV +++ [pid 6072] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] <... umount2 resumed>) = 0 [pid 6072] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5831] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6072] <... mmap resumed>) = 0x7f476940f000 [pid 6072] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5833] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... openat resumed>) = 3 [pid 6072] <... mprotect resumed>) = 0 [pid 6068] +++ killed by SIGSEGV +++ [pid 6066] +++ killed by SIGSEGV +++ [pid 5831] newfstatat(3, "", [pid 6072] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6072] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5833] newfstatat(AT_FDCWD, "./19/file1", [pid 5831] getdents64(3, [pid 6072] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6066, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- ./strace-static-x86_64: Process 6074 attached [pid 5833] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6074] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6072] <... clone3 resumed> => {parent_tid=[6074]}, 88) = 6074 [pid 5829] restart_syscall(<... resuming interrupted clone ...> [pid 6074] <... rseq resumed>) = 0 [pid 6072] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] <... restart_syscall resumed>) = 0 [pid 6074] set_robust_list(0x7f476942f9a0, 24 [pid 6072] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] <... openat resumed>) = 4 [pid 6072] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 5833] newfstatat(4, "", [pid 6072] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6074] <... set_robust_list resumed>) = 0 [pid 6074] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] getdents64(4, [pid 5829] umount2("./18", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] getdents64(4, [pid 5829] openat(AT_FDCWD, "./18", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] <... openat resumed>) = 3 [pid 5833] close(4 [pid 5829] newfstatat(3, "", [pid 5833] <... close resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] rmdir("./19/file1" [pid 5829] getdents64(3, [pid 6074] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 5833] umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [ 111.227481][ T6070] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 5829] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6074] memfd_create("syzkaller", 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... umount2 resumed>) = 0 [pid 5829] <... umount2 resumed>) = 0 [pid 5831] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] newfstatat(AT_FDCWD, "./19/file1", [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6074] <... memfd_create resumed>) = 3 [pid 5833] newfstatat(AT_FDCWD, "./19/binderfs", [pid 5831] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] newfstatat(AT_FDCWD, "./18/file1", [pid 6074] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5829] umount2("./18/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... openat resumed>) = 4 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5833] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] newfstatat(4, "", [pid 5829] openat(AT_FDCWD, "./18/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6074] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5833] unlink("./19/binderfs" [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5829] <... openat resumed>) = 4 [pid 5833] <... unlink resumed>) = 0 [pid 5831] getdents64(4, [pid 5829] newfstatat(4, "", [pid 6074] <... write resumed>) = 131072 [pid 6074] munmap(0x7f4761000000, 138412032 [pid 5833] getdents64(3, [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5833] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] getdents64(4, [pid 5829] getdents64(4, [pid 6074] <... munmap resumed>) = 0 [pid 5833] close(3 [pid 5831] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5833] <... close resumed>) = 0 [pid 5831] close(4 [pid 5829] getdents64(4, [pid 6074] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5833] rmdir("./19" [pid 5831] <... close resumed>) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6074] <... openat resumed>) = 4 [pid 6070] <... mount resumed>) = 0 [pid 5833] <... rmdir resumed>) = 0 [pid 5831] rmdir("./19/file1" [pid 5829] close(4 [pid 5833] mkdir("./20", 0777 [pid 5831] <... rmdir resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 6074] ioctl(4, LOOP_SET_FD, 3 [pid 6070] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5831] umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5829] rmdir("./18/file1" [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5829] <... rmdir resumed>) = 0 [pid 5831] newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5829] umount2("./18/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] unlink("./19/binderfs") = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] getdents64(3, [pid 5829] newfstatat(AT_FDCWD, "./18/binderfs", [pid 5831] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6070] <... openat resumed>) = 3 [pid 5831] close(3 [pid 5829] unlink("./18/binderfs" [pid 5831] <... close resumed>) = 0 [pid 5829] <... unlink resumed>) = 0 [pid 5831] rmdir("./19" [pid 5829] getdents64(3, [pid 5831] <... rmdir resumed>) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] mkdir("./20", 0777 [pid 5829] close(3 [pid 5831] <... mkdir resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5829] rmdir("./18" [pid 6070] chdir("./file1" [pid 5829] <... rmdir resumed>) = 0 [pid 6074] <... ioctl resumed>) = 0 [pid 6070] <... chdir resumed>) = 0 [pid 5833] <... mkdir resumed>) = 0 [pid 5829] mkdir("./19", 0777 [pid 6074] close(3 [pid 6070] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5831] <... openat resumed>) = 3 [pid 5831] ioctl(3, LOOP_CLR_FD [pid 6070] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5831] <... ioctl resumed>) = 0 [pid 6070] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6074] <... close resumed>) = 0 [pid 6070] <... futex resumed>) = 1 [pid 6069] <... futex resumed>) = 0 [pid 5831] close(3 [pid 5829] <... mkdir resumed>) = 0 [pid 6074] close(4 [pid 6070] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6074] <... close resumed>) = 0 [pid 6069] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6074] mkdir("./file1", 0777 [pid 6070] <... futex resumed>) = 0 [pid 6069] <... futex resumed>) = 1 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 6069] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... openat resumed>) = 3 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5829] <... openat resumed>) = 3 [pid 5833] <... ioctl resumed>) = 0 [pid 5829] ioctl(3, LOOP_CLR_FD [pid 5833] close(3 [pid 5829] <... ioctl resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 5829] close(3 [pid 6070] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5831] <... close resumed>) = 0 [ 111.326045][ T6074] loop1: detected capacity change from 0 to 256 [pid 6074] <... mkdir resumed>) = 0 [pid 6070] <... openat resumed>) = 4 [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6074] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 6070] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6069] <... futex resumed>) = 0 [pid 6070] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6069] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6070] <... futex resumed>) = 0 [pid 6069] <... futex resumed>) = 1 ./strace-static-x86_64: Process 6075 attached ./strace-static-x86_64: Process 6076 attached [pid 6070] mkdir("./file2", 0777 [pid 6069] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 6075 [pid 6075] set_robust_list(0x5555612166a0, 24) = 0 [pid 6076] set_robust_list(0x5555612166a0, 24 [pid 6075] chdir("./20" [pid 6076] <... set_robust_list resumed>) = 0 [pid 6076] chdir("./20") = 0 [pid 6075] <... chdir resumed>) = 0 [pid 6076] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6075] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6075] setpgid(0, 0) = 0 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 6076 [pid 6075] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6076] <... prctl resumed>) = 0 [pid 6075] <... openat resumed>) = 3 [pid 6075] write(3, "1000", 4) = 4 [pid 6076] setpgid(0, 0 [pid 6075] close(3) = 0 [pid 6075] symlink("/dev/binderfs", "./binderfs" [pid 6076] <... setpgid resumed>) = 0 [pid 6076] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6075] <... symlink resumed>) = 0 [pid 6076] <... openat resumed>) = 3 executing program [pid 6076] write(3, "1000", 4) = 4 [pid 6075] write(1, "executing program\n", 18 [pid 6076] close(3 [pid 6075] <... write resumed>) = 18 [pid 6076] <... close resumed>) = 0 [pid 6076] symlink("/dev/binderfs", "./binderfs" [pid 6075] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6075] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 6076] <... symlink resumed>) = 0 [pid 6076] write(1, "executing program\n", 18 [pid 6075] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6075] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 6075] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6075] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6075] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0}executing program ./strace-static-x86_64: Process 6077 attached [pid 6077] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053) = 0 [pid 6076] <... write resumed>) = 18 [pid 6075] <... clone3 resumed> => {parent_tid=[6077]}, 88) = 6077 [pid 6075] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6075] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6075] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6077] set_robust_list(0x7f476942f9a0, 24) = 0 [pid 6077] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6077] memfd_create("syzkaller", 0) = 3 [pid 6077] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [ 111.393353][ T6070] exFAT-fs (loop3): error, data size is invalid(9000) [ 111.418425][ T6070] exFAT-fs (loop3): Filesystem has been set read-only [pid 6077] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 6076] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... close resumed>) = 0 [pid 6076] <... futex resumed>) = 0 [pid 6069] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6078 attached [pid 6076] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6069] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 6078 [ 111.431908][ T6074] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6077] munmap(0x7f4761000000, 138412032 [pid 6078] set_robust_list(0x5555612166a0, 24 [pid 6077] <... munmap resumed>) = 0 [pid 6076] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6074] <... mount resumed>) = 0 [pid 6070] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6069] <... futex resumed>) = 0 [pid 6078] <... set_robust_list resumed>) = 0 [pid 6076] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6070] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6069] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6078] chdir("./19" [pid 6076] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6069] <... mmap resumed>) = ? [pid 6076] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6078] <... chdir resumed>) = 0 [pid 6077] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 6076] <... mmap resumed>) = 0x7f476940f000 [pid 6074] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6070] +++ killed by SIGSEGV +++ [pid 6069] +++ killed by SIGSEGV +++ [pid 6078] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6076] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6074] <... openat resumed>) = 3 [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6069, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 6076] <... mprotect resumed>) = 0 [pid 6078] <... prctl resumed>) = 0 [pid 6074] chdir("./file1" [pid 6077] <... openat resumed>) = 4 [pid 6076] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] restart_syscall(<... resuming interrupted clone ...> [pid 6077] ioctl(4, LOOP_SET_FD, 3 [pid 6076] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] <... restart_syscall resumed>) = 0 [pid 5832] umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5832] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5832] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] getdents64(3, 0x555561217730 /* 4 entries */, 32768) = 112 [pid 5832] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6076] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6074] <... chdir resumed>) = 0 [pid 5832] <... umount2 resumed>) = 0 [pid 5832] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6074] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./19/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 6079 attached [pid 6076] <... clone3 resumed> => {parent_tid=[6079]}, 88) = 6079 [pid 6074] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6079] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6078] setpgid(0, 0 [pid 6076] rt_sigprocmask(SIG_SETMASK, [], [pid 6074] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6079] <... rseq resumed>) = 0 [ 111.539310][ T6077] loop4: detected capacity change from 0 to 256 [pid 6079] set_robust_list(0x7f476942f9a0, 24 [pid 6078] <... setpgid resumed>) = 0 [pid 6077] <... ioctl resumed>) = 0 [pid 6076] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6074] <... futex resumed>) = 1 [pid 6072] <... futex resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6074] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6076] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6072] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6079] <... set_robust_list resumed>) = 0 [pid 5832] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6079] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] <... openat resumed>) = 4 [pid 6079] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] newfstatat(4, "", [pid 6079] memfd_create("syzkaller", 0 [pid 6078] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6076] <... futex resumed>) = 0 [pid 6074] <... futex resumed>) = 0 [pid 6072] <... futex resumed>) = 1 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6076] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6074] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6072] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6079] <... memfd_create resumed>) = 3 [pid 6078] <... openat resumed>) = 3 [pid 5832] getdents64(4, [pid 6079] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6077] close(3 [pid 6074] <... openat resumed>) = 4 [pid 6079] <... mmap resumed>) = 0x7f4761000000 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5832] getdents64(4, [pid 6077] <... close resumed>) = 0 [pid 6077] close(4 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6079] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6078] write(3, "1000", 4 [pid 6077] <... close resumed>) = 0 [pid 6074] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] close(4 [pid 6078] <... write resumed>) = 4 [pid 6077] mkdir("./file1", 0777 [pid 6074] <... futex resumed>) = 1 [pid 6072] <... futex resumed>) = 0 [pid 5832] <... close resumed>) = 0 [pid 5832] rmdir("./19/file1" [pid 6072] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... rmdir resumed>) = 0 [pid 6079] <... write resumed>) = 131072 [pid 6078] close(3 [pid 6077] <... mkdir resumed>) = 0 [pid 6074] mkdir("./file2", 0777 [pid 6072] <... futex resumed>) = 0 [pid 6079] munmap(0x7f4761000000, 138412032 [pid 6078] <... close resumed>) = 0 [pid 6072] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./19/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] unlink("./19/binderfs") = 0 [pid 5832] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] close(3) = 0 [pid 6079] <... munmap resumed>) = 0 [pid 6078] symlink("/dev/binderfs", "./binderfs" [pid 6077] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 5832] rmdir("./19" [pid 6078] <... symlink resumed>) = 0 [pid 5832] <... rmdir resumed>) = 0 [ 111.685669][ T6074] exFAT-fs (loop1): error, data size is invalid(9000) [ 111.716883][ T6074] exFAT-fs (loop1): Filesystem has been set read-only executing program [pid 6079] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 6078] write(1, "executing program\n", 18 [pid 5832] mkdir("./20", 0777 [pid 6079] <... openat resumed>) = 4 [pid 6078] <... write resumed>) = 18 [pid 5832] <... mkdir resumed>) = 0 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6078] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6079] ioctl(4, LOOP_SET_FD, 3 [pid 5832] <... openat resumed>) = 3 [pid 5832] ioctl(3, LOOP_CLR_FD) = 0 [pid 5832] close(3) = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6078] <... futex resumed>) = 0 [pid 6072] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 6072] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6078] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6072] <... futex resumed>) = 0 [pid 6072] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 6080 attached [pid 6078] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6072] <... mmap resumed>) = 0x7f47693ee000 [pid 6078] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6072] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 6080 [pid 6080] set_robust_list(0x5555612166a0, 24 [pid 6078] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6072] <... mprotect resumed>) = 0 [pid 6072] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6080] <... set_robust_list resumed>) = 0 [pid 6078] <... mmap resumed>) = 0x7f476940f000 [pid 6072] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6080] chdir("./20" [pid 6078] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6072] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 6080] <... chdir resumed>) = 0 ./strace-static-x86_64: Process 6081 attached [pid 6080] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6081] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6080] <... prctl resumed>) = 0 [pid 6078] <... mprotect resumed>) = 0 [pid 6072] <... clone3 resumed> => {parent_tid=[6081]}, 88) = 6081 [pid 6081] <... rseq resumed>) = 0 [pid 6072] rt_sigprocmask(SIG_SETMASK, [], [pid 6080] setpgid(0, 0) = 0 [pid 6080] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6081] set_robust_list(0x7f476940e9a0, 24 [pid 6080] <... openat resumed>) = 3 [pid 6079] <... ioctl resumed>) = 0 [pid 6078] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6072] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6081] <... set_robust_list resumed>) = 0 [pid 6080] write(3, "1000", 4 [pid 6079] close(3 [pid 6078] <... rt_sigprocmask resumed>[], 8) = 0 [ 111.736184][ T6079] loop2: detected capacity change from 0 to 256 [pid 6072] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6081] rt_sigprocmask(SIG_SETMASK, [], [pid 6080] <... write resumed>) = 4 [pid 6078] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6072] <... futex resumed>) = 0 [pid 6081] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6080] close(3 [pid 6079] <... close resumed>) = 0 [pid 6077] <... mount resumed>) = 0 [pid 6074] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6072] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6081] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 6080] <... close resumed>) = 0 [pid 6079] close(4 [pid 6077] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6074] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- ./strace-static-x86_64: Process 6082 attached [ 111.807401][ T6077] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6080] symlink("/dev/binderfs", "./binderfs" [pid 6082] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6080] <... symlink resumed>) = 0 [pid 6079] <... close resumed>) = 0 [pid 6077] <... openat resumed>) = 3 [pid 6081] <... ioctl resumed>) = ? [pid 6080] write(1, "executing program\n", 18 [pid 6072] <... futex resumed>) = ? [pid 6081] +++ killed by SIGSEGV +++ [pid 6079] mkdir("./file1", 0777executing program [pid 6080] <... write resumed>) = 18 [pid 6080] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6082] <... rseq resumed>) = 0 [pid 6080] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6079] <... mkdir resumed>) = 0 [pid 6080] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6080] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6080] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 6080] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6080] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6074] +++ killed by SIGSEGV +++ [pid 6072] +++ killed by SIGSEGV +++ [pid 6082] set_robust_list(0x7f476942f9a0, 24 [pid 6080] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6079] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 6082] <... set_robust_list resumed>) = 0 [pid 6080] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6078] <... clone3 resumed> => {parent_tid=[6082]}, 88) = 6082 ./strace-static-x86_64: Process 6083 attached [pid 6082] rt_sigprocmask(SIG_SETMASK, [], [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6072, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 6080] <... clone3 resumed> => {parent_tid=[6083]}, 88) = 6083 [pid 6082] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6077] chdir("./file1" [pid 5830] restart_syscall(<... resuming interrupted clone ...> [pid 6083] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6082] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6080] rt_sigprocmask(SIG_SETMASK, [], [pid 6078] rt_sigprocmask(SIG_SETMASK, [], [pid 6077] <... chdir resumed>) = 0 [pid 5830] <... restart_syscall resumed>) = 0 [pid 6083] <... rseq resumed>) = 0 [pid 6080] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6078] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6077] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 6083] set_robust_list(0x7f476942f9a0, 24 [pid 6080] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6078] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6077] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6083] <... set_robust_list resumed>) = 0 [pid 6080] <... futex resumed>) = 0 [pid 6077] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6083] rt_sigprocmask(SIG_SETMASK, [], [pid 6080] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6077] <... futex resumed>) = 1 [pid 6075] <... futex resumed>) = 0 [pid 6083] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6082] <... futex resumed>) = 0 [pid 6078] <... futex resumed>) = 1 [pid 6077] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6075] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6083] memfd_create("syzkaller", 0 [pid 6082] memfd_create("syzkaller", 0 [pid 6078] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6077] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6075] <... futex resumed>) = 0 [pid 6083] <... memfd_create resumed>) = 3 [pid 6082] <... memfd_create resumed>) = 3 [pid 6077] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6075] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6083] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6082] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6083] <... mmap resumed>) = 0x7f4761000000 [pid 6077] <... openat resumed>) = 4 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6082] <... mmap resumed>) = 0x7f4761000000 [pid 5830] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6077] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6083] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6077] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6075] <... futex resumed>) = 0 [pid 5830] <... openat resumed>) = 3 [pid 5830] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5830] getdents64(3, [pid 6075] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6077] <... futex resumed>) = 0 [pid 6075] <... futex resumed>) = 1 [pid 5830] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6077] mkdir("./file2", 0777 [pid 6075] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6083] <... write resumed>) = 131072 [pid 5830] <... umount2 resumed>) = 0 [pid 6083] munmap(0x7f4761000000, 138412032) = 0 [pid 6082] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5830] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6083] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6083] <... openat resumed>) = 4 [pid 6083] ioctl(4, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 6083] ioctl(4, LOOP_CLR_FD) = 0 [pid 5830] newfstatat(AT_FDCWD, "./19/file1", [pid 6082] <... write resumed>) = 131072 [pid 6075] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6083] ioctl(4, LOOP_SET_FD, 3 [pid 6075] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6083] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 6075] <... futex resumed>) = 0 [pid 6083] close(4 [pid 6075] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5830] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6083] <... close resumed>) = 0 [pid 6075] <... mmap resumed>) = 0x7f47693ee000 [pid 6075] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5830] <... openat resumed>) = 4 [pid 6083] close(3 [pid 6075] <... mprotect resumed>) = 0 [pid 6083] <... close resumed>) = 0 [ 111.915285][ T6077] exFAT-fs (loop4): error, data size is invalid(9000) [ 111.954468][ T6077] exFAT-fs (loop4): Filesystem has been set read-only [pid 6075] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6075] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} => {parent_tid=[6084]}, 88) = 6084 [pid 6082] munmap(0x7f4761000000, 138412032./strace-static-x86_64: Process 6084 attached [pid 5830] newfstatat(4, "", [pid 6082] <... munmap resumed>) = 0 [pid 6075] rt_sigprocmask(SIG_SETMASK, [], [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6083] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6075] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6084] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6083] <... futex resumed>) = 1 [pid 6082] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 6080] <... futex resumed>) = 0 [pid 6075] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] getdents64(4, [pid 6080] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6084] <... rseq resumed>) = 0 [pid 6082] <... openat resumed>) = 4 [pid 6080] <... futex resumed>) = 0 [pid 5830] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6075] <... futex resumed>) = 0 [pid 6075] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6080] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] getdents64(4, [pid 6084] set_robust_list(0x7f476940e9a0, 24 [pid 6082] ioctl(4, LOOP_SET_FD, 3 [pid 6084] <... set_robust_list resumed>) = 0 [pid 6083] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 3 [pid 6083] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6083] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6084] rt_sigprocmask(SIG_SETMASK, [], [pid 6080] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6077] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5830] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6084] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6080] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] close(4 [pid 6084] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 6080] <... futex resumed>) = 1 [pid 5830] <... close resumed>) = 0 [pid 6080] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6083] <... futex resumed>) = 0 [pid 6084] <... ioctl resumed>) = 0 [pid 6083] mkdir("./file2", 0777 [pid 5830] rmdir("./19/file1" [pid 6084] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6083] <... mkdir resumed>) = 0 [pid 5830] <... rmdir resumed>) = 0 [pid 6082] <... ioctl resumed>) = 0 [pid 5830] umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6084] <... futex resumed>) = 1 [pid 6083] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6075] <... futex resumed>) = 0 [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6084] futex(0x7f47695046d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6080] <... futex resumed>) = ? [pid 5830] newfstatat(AT_FDCWD, "./19/binderfs", [pid 6083] +++ killed by SIGSEGV +++ [pid 5830] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6080] +++ killed by SIGSEGV +++ [pid 6077] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5830] unlink("./19/binderfs" [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6080, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 6082] close(3 [pid 5832] restart_syscall(<... resuming interrupted clone ...> [pid 5830] <... unlink resumed>) = 0 [pid 6084] <... futex resumed>) = ? [pid 6082] <... close resumed>) = 0 [pid 6079] <... mount resumed>) = 0 [pid 5832] <... restart_syscall resumed>) = 0 [pid 5830] getdents64(3, [pid 6084] +++ killed by SIGSEGV +++ [pid 5832] umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5832] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5832] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6079] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5832] getdents64(3, [pid 6079] <... openat resumed>) = 3 [pid 5832] <... getdents64 resumed>0x555561217730 /* 5 entries */, 32768) = 144 [pid 5832] umount2("./20/devices.list", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./20/devices.list", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6079] chdir("./file1" [pid 5832] unlink("./20/devices.list" [pid 6079] <... chdir resumed>) = 0 [pid 5832] <... unlink resumed>) = 0 [ 111.998915][ T6079] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 112.026583][ T6082] loop0: detected capacity change from 0 to 256 [pid 6079] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5832] umount2("./20/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6079] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6079] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] newfstatat(AT_FDCWD, "./20/binderfs", [pid 6082] close(4 [pid 6079] <... futex resumed>) = 1 [pid 6077] +++ killed by SIGSEGV +++ [pid 6076] <... futex resumed>) = 0 [pid 6075] +++ killed by SIGSEGV +++ [pid 5832] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6076] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6082] <... close resumed>) = 0 [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6075, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5832] unlink("./20/binderfs" [pid 6076] <... futex resumed>) = 0 [pid 5832] <... unlink resumed>) = 0 [pid 5830] close(3 [pid 6076] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] umount2("./20/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6082] mkdir("./file1", 0777 [pid 6079] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 5833] umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] <... close resumed>) = 0 [pid 6082] <... mkdir resumed>) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./20/file2", [pid 5833] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5830] rmdir("./19" [pid 5832] umount2("./20/file2", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] <... openat resumed>) = 3 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] openat(AT_FDCWD, "./20/file2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5833] newfstatat(3, "", [pid 5832] <... openat resumed>) = 4 [pid 5830] <... rmdir resumed>) = 0 [pid 6079] <... openat resumed>) = 4 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] newfstatat(4, "", [pid 5830] mkdir("./20", 0777 [pid 6082] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 5833] getdents64(3, [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6079] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] getdents64(4, [pid 5830] <... mkdir resumed>) = 0 [pid 6079] <... futex resumed>) = 1 [pid 5833] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6076] <... futex resumed>) = 0 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6076] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 6079] mkdir("./file2", 0777 [pid 5832] getdents64(4, [pid 6076] <... futex resumed>) = 0 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5830] <... openat resumed>) = 3 [pid 6076] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5833] <... umount2 resumed>) = 0 [pid 5832] close(4 [pid 5830] ioctl(3, LOOP_CLR_FD [pid 5833] umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] <... ioctl resumed>) = 0 [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] close(3 [pid 5833] newfstatat(AT_FDCWD, "./20/file1", [pid 5832] <... close resumed>) = 0 [pid 5832] rmdir("./20/file2" [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5832] <... rmdir resumed>) = 0 [pid 5830] <... close resumed>) = 0 [pid 5833] umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5830] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5832] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [ 112.101576][ T6079] exFAT-fs (loop2): error, data size is invalid(9000) ./strace-static-x86_64: Process 6085 attached [pid 5833] openat(AT_FDCWD, "./20/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5832] close(3) = 0 [pid 6085] set_robust_list(0x5555612166a0, 24 [pid 6076] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5833] <... openat resumed>) = 4 [pid 5830] <... clone resumed>, child_tidptr=0x555561216690) = 6085 [pid 5832] rmdir("./20" [pid 6085] <... set_robust_list resumed>) = 0 [pid 6076] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] newfstatat(4, "", [pid 5832] <... rmdir resumed>) = 0 [pid 6085] chdir("./20" [pid 6076] <... futex resumed>) = 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5832] mkdir("./21", 0777 [pid 6085] <... chdir resumed>) = 0 [pid 6076] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] getdents64(4, [pid 6085] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6076] <... mmap resumed>) = 0x7f47693ee000 [pid 5833] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6085] <... prctl resumed>) = 0 [pid 6076] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 6085] setpgid(0, 0 [pid 6076] <... mprotect resumed>) = 0 [pid 6085] <... setpgid resumed>) = 0 [pid 6076] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5833] getdents64(4, [pid 6085] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6076] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5833] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6079] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6079] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [ 112.137401][ T6082] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 112.154249][ T6079] exFAT-fs (loop2): Filesystem has been set read-only [pid 5832] <... mkdir resumed>) = 0 [pid 6085] <... openat resumed>) = 3 [pid 6076] <... clone3 resumed> ) = ? [pid 5833] close(4 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6082] <... mount resumed>) = 0 [pid 6085] write(3, "1000", 4 [pid 5833] <... close resumed>) = 0 [pid 5832] <... openat resumed>) = 3 [pid 5832] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 5833] rmdir("./20/file1" [pid 6085] <... write resumed>) = 4 [pid 6082] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6079] +++ killed by SIGSEGV +++ [pid 6076] +++ killed by SIGSEGV +++ [pid 5832] close(3) = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5831] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6076, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=4 /* 0.04 s */} --- [pid 5831] restart_syscall(<... resuming interrupted clone ...>./strace-static-x86_64: Process 6086 attached [pid 6085] close(3 [pid 6082] <... openat resumed>) = 3 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 6086 [pid 5831] <... restart_syscall resumed>) = 0 [pid 5833] <... rmdir resumed>) = 0 [pid 6085] <... close resumed>) = 0 [pid 6082] chdir("./file1" [pid 6086] set_robust_list(0x5555612166a0, 24 [pid 6085] symlink("/dev/binderfs", "./binderfs" [pid 6082] <... chdir resumed>) = 0 [pid 5831] umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6082] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 6086] <... set_robust_list resumed>) = 0 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6085] <... symlink resumed>) = 0 executing program [pid 6086] chdir("./21" [pid 6085] write(1, "executing program\n", 18 [pid 6082] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5831] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6085] <... write resumed>) = 18 [pid 6082] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5833] umount2("./20/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6085] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6082] <... futex resumed>) = 1 [pid 6078] <... futex resumed>) = 0 [pid 6082] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5833] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6085] <... futex resumed>) = 0 [pid 6082] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6078] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6082] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6085] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6078] <... futex resumed>) = 0 [pid 6086] <... chdir resumed>) = 0 [pid 6078] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5831] <... openat resumed>) = 3 [pid 6086] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5831] newfstatat(3, "", [pid 6086] <... prctl resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6086] setpgid(0, 0 [pid 6082] <... openat resumed>) = 4 [pid 5831] getdents64(3, [pid 6086] <... setpgid resumed>) = 0 [pid 6082] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6086] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6082] <... futex resumed>) = 1 [pid 6078] <... futex resumed>) = 0 [pid 5831] umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6086] <... openat resumed>) = 3 [pid 6085] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6082] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6078] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6086] write(3, "1000", 4) = 4 [pid 6082] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6078] <... futex resumed>) = 0 [pid 6086] close(3executing program ) = 0 [pid 6082] mkdir("./file2", 0777 [pid 6078] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6086] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6086] write(1, "executing program\n", 18) = 18 [pid 6086] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6086] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 6086] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6086] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 6086] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6086] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6086] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6085] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 5833] newfstatat(AT_FDCWD, "./20/binderfs", [pid 6085] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6085] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 6087 attached [pid 6085] <... mmap resumed>) = 0x7f476940f000 [pid 5833] unlink("./20/binderfs" [pid 5831] <... umount2 resumed>) = 0 [pid 6087] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6086] <... clone3 resumed> => {parent_tid=[6087]}, 88) = 6087 [pid 5831] umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6087] <... rseq resumed>) = 0 [pid 6086] rt_sigprocmask(SIG_SETMASK, [], [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6087] set_robust_list(0x7f476942f9a0, 24 [pid 6086] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5831] newfstatat(AT_FDCWD, "./20/file1", [pid 6087] <... set_robust_list resumed>) = 0 [pid 6086] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6087] rt_sigprocmask(SIG_SETMASK, [], [pid 6086] <... futex resumed>) = 0 [pid 5833] <... unlink resumed>) = 0 [pid 5831] umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6087] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6086] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6085] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6087] memfd_create("syzkaller", 0 [pid 5831] openat(AT_FDCWD, "./20/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6087] <... memfd_create resumed>) = 3 [pid 6085] <... mprotect resumed>) = 0 [pid 5833] getdents64(3, [pid 5831] <... openat resumed>) = 4 [pid 6087] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5831] newfstatat(4, "", [pid 6078] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5833] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6087] <... mmap resumed>) = 0x7f4761000000 [pid 6078] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5831] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6087] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6085] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6082] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6078] <... futex resumed>) = 0 [pid 5833] close(3 [pid 5831] getdents64(4, [pid 6087] <... write resumed>) = 131072 [pid 6085] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6078] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5833] <... close resumed>) = 0 [pid 6082] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6078] <... mmap resumed>) = 0x7f47693ee000 [pid 5833] rmdir("./20") = 0 [pid 6085] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5831] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 5831] getdents64(4, 0x55556121f770 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 6088 attached [pid 5831] close(4 [pid 6087] munmap(0x7f4761000000, 138412032 [pid 5831] <... close resumed>) = 0 [pid 6087] <... munmap resumed>) = 0 [pid 5831] rmdir("./20/file1" [pid 6087] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6085] <... clone3 resumed> => {parent_tid=[6088]}, 88) = 6088 [pid 6082] +++ killed by SIGSEGV +++ [pid 6078] +++ killed by SIGSEGV +++ [pid 5831] <... rmdir resumed>) = 0 [pid 6088] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6087] <... openat resumed>) = 4 [pid 6085] rt_sigprocmask(SIG_SETMASK, [], [pid 5833] mkdir("./21", 0777 [pid 5831] umount2("./20/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6088] <... rseq resumed>) = 0 [pid 6085] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6088] set_robust_list(0x7f476942f9a0, 24 [pid 5829] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6078, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 6085] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6088] <... set_robust_list resumed>) = 0 [pid 6085] <... futex resumed>) = 0 [pid 5829] restart_syscall(<... resuming interrupted clone ...> [pid 6088] rt_sigprocmask(SIG_SETMASK, [], [pid 6085] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6088] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 112.237998][ T6082] exFAT-fs (loop0): error, data size is invalid(9000) [ 112.266059][ T6082] exFAT-fs (loop0): Filesystem has been set read-only [pid 6087] ioctl(4, LOOP_SET_FD, 3 [pid 5831] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6088] memfd_create("syzkaller", 0 [pid 5833] <... mkdir resumed>) = 0 [pid 5831] newfstatat(AT_FDCWD, "./20/binderfs", [pid 5829] <... restart_syscall resumed>) = 0 [pid 5831] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5831] unlink("./20/binderfs" [pid 5829] umount2("./19", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5831] <... unlink resumed>) = 0 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5831] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5831] close(3 [pid 5829] openat(AT_FDCWD, "./19", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 5831] <... close resumed>) = 0 [pid 5829] <... openat resumed>) = 3 [pid 5831] rmdir("./20" [pid 5829] newfstatat(3, "", [pid 5831] <... rmdir resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6088] <... memfd_create resumed>) = 3 [pid 5829] getdents64(3, [pid 5831] mkdir("./21", 0777 [pid 6088] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 5833] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 5831] <... mkdir resumed>) = 0 [pid 5829] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6088] <... mmap resumed>) = 0x7f4761000000 [pid 5831] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5829] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] <... openat resumed>) = 3 [pid 5833] ioctl(3, LOOP_CLR_FD [pid 5831] <... openat resumed>) = 3 [pid 5831] ioctl(3, LOOP_CLR_FD) = 0 [pid 5833] <... ioctl resumed>) = 0 [pid 5831] close(3 [pid 6088] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 5833] close(3 [pid 5831] <... close resumed>) = 0 [pid 5829] <... umount2 resumed>) = 0 [pid 5833] <... close resumed>) = 0 [pid 5829] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5829] newfstatat(AT_FDCWD, "./19/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6088] <... write resumed>) = 131072 [pid 5833] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] umount2("./19/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5831] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 5829] openat(AT_FDCWD, "./19/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 6090 attached ./strace-static-x86_64: Process 6089 attached [pid 6087] <... ioctl resumed>) = 0 [pid 5829] <... openat resumed>) = 4 [pid 5833] <... clone resumed>, child_tidptr=0x555561216690) = 6089 [pid 6089] set_robust_list(0x5555612166a0, 24 [pid 5829] newfstatat(4, "", [pid 6089] <... set_robust_list resumed>) = 0 [pid 6088] munmap(0x7f4761000000, 138412032 [pid 6087] close(3 [pid 5829] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 112.316544][ T6087] loop3: detected capacity change from 0 to 256 [pid 6089] chdir("./21" [pid 6088] <... munmap resumed>) = 0 [pid 6087] <... close resumed>) = 0 [pid 5831] <... clone resumed>, child_tidptr=0x555561216690) = 6090 [pid 5829] getdents64(4, [pid 6090] set_robust_list(0x5555612166a0, 24 [pid 6089] <... chdir resumed>) = 0 [pid 6088] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 6087] close(4 [pid 6089] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6088] <... openat resumed>) = 4 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6090] <... set_robust_list resumed>) = 0 [pid 6089] <... prctl resumed>) = 0 [pid 6088] ioctl(4, LOOP_SET_FD, 3 [pid 6087] <... close resumed>) = 0 [pid 5829] getdents64(4, [pid 6090] chdir("./21" [pid 6089] setpgid(0, 0 [pid 6087] mkdir("./file1", 0777 [pid 6090] <... chdir resumed>) = 0 [pid 6087] <... mkdir resumed>) = 0 [pid 5829] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 6090] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6087] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 5829] close(4 [pid 6090] <... prctl resumed>) = 0 [pid 6089] <... setpgid resumed>) = 0 [pid 6090] setpgid(0, 0 [pid 5829] <... close resumed>) = 0 [pid 6090] <... setpgid resumed>) = 0 [pid 5829] rmdir("./19/file1" [pid 6090] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6089] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 6090] <... openat resumed>) = 3 executing program [pid 6089] <... openat resumed>) = 3 [pid 5829] <... rmdir resumed>) = 0 [pid 6090] write(3, "1000", 4 [pid 6089] write(3, "1000", 4 [pid 6088] <... ioctl resumed>) = 0 [pid 6089] <... write resumed>) = 4 [pid 6089] close(3 [pid 6088] close(3 [pid 6090] <... write resumed>) = 4 [pid 6089] <... close resumed>) = 0 [pid 6088] <... close resumed>) = 0 [pid 5829] umount2("./19/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6089] symlink("/dev/binderfs", "./binderfs" [pid 6088] close(4 [pid 6089] <... symlink resumed>) = 0 [pid 6088] <... close resumed>) = 0 [pid 6089] write(1, "executing program\n", 18 [pid 6088] mkdir("./file1", 0777 [pid 6089] <... write resumed>) = 18 [pid 6088] <... mkdir resumed>) = 0 [pid 6089] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6089] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, NULL, 8) = 0 [pid 6089] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6089] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 6089] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6088] mount("/dev/loop1", "./file1", "exfat", 0, "" [pid 6089] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6090] close(3 [pid 5829] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6090] <... close resumed>) = 0 [ 112.398716][ T6088] loop1: detected capacity change from 0 to 256 [ 112.419464][ T6087] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6089] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 5829] newfstatat(AT_FDCWD, "./19/binderfs", [pid 6090] symlink("/dev/binderfs", "./binderfs" [pid 6089] <... clone3 resumed> => {parent_tid=[6091]}, 88) = 6091 [pid 6089] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6089] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6089] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 6091 attached executing program [pid 6090] <... symlink resumed>) = 0 [pid 6087] <... mount resumed>) = 0 [pid 5829] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6090] write(1, "executing program\n", 18 [pid 6087] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 5829] unlink("./19/binderfs" [pid 6091] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053) = 0 [pid 6090] <... write resumed>) = 18 [pid 6087] <... openat resumed>) = 3 [pid 5829] <... unlink resumed>) = 0 [pid 6091] set_robust_list(0x7f476942f9a0, 24 [pid 6087] chdir("./file1" [pid 6091] <... set_robust_list resumed>) = 0 [pid 6090] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6088] <... mount resumed>) = 0 [pid 6087] <... chdir resumed>) = 0 [pid 5829] getdents64(3, [pid 6091] rt_sigprocmask(SIG_SETMASK, [], [pid 6090] <... futex resumed>) = 0 [ 112.450917][ T6088] exFAT-fs (loop1): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6087] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6091] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6090] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6088] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6087] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 5829] <... getdents64 resumed>0x555561217730 /* 0 entries */, 32768) = 0 [pid 6091] memfd_create("syzkaller", 0 [pid 6090] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6088] <... openat resumed>) = 3 [pid 6087] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] close(3 [pid 6091] <... memfd_create resumed>) = 3 [pid 6091] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4761000000 [pid 6091] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072) = 131072 [pid 6090] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6088] chdir("./file1" [pid 6087] <... futex resumed>) = 1 [pid 6086] <... futex resumed>) = 0 [pid 5829] <... close resumed>) = 0 [pid 6087] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6090] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6088] <... chdir resumed>) = 0 [pid 6086] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] rmdir("./19" [pid 6090] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6088] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 6087] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6086] <... futex resumed>) = 0 [pid 6091] munmap(0x7f4761000000, 138412032) = 0 [pid 6087] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6086] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5829] <... rmdir resumed>) = 0 [pid 6088] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6091] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 6091] ioctl(4, LOOP_SET_FD, 3 [pid 6090] <... mmap resumed>) = 0x7f476940f000 [pid 6088] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6087] <... openat resumed>) = 4 [pid 5829] mkdir("./20", 0777 [pid 6090] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6088] <... futex resumed>) = 1 [pid 6087] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6090] <... mprotect resumed>) = 0 [pid 6088] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6087] <... futex resumed>) = 1 [pid 6086] <... futex resumed>) = 0 [pid 6085] <... futex resumed>) = 0 [pid 5829] <... mkdir resumed>) = 0 [pid 6086] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5829] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 6087] mkdir("./file2", 0777 [pid 6086] <... futex resumed>) = 0 [pid 6090] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6086] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6085] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6088] <... futex resumed>) = 0 [pid 6085] <... futex resumed>) = 1 [pid 6088] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6085] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6091] <... ioctl resumed>) = 0 [pid 6091] close(3 [pid 5829] <... openat resumed>) = 3 [ 112.519493][ T6091] loop4: detected capacity change from 0 to 256 [ 112.536584][ T6087] exFAT-fs (loop3): error, data size is invalid(9000) [pid 6091] <... close resumed>) = 0 [pid 6090] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6087] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5829] ioctl(3, LOOP_CLR_FD [pid 6090] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6087] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5829] <... ioctl resumed>) = 0 ./strace-static-x86_64: Process 6092 attached [pid 6091] close(4 [pid 6088] <... openat resumed>) = 4 [pid 6086] <... futex resumed>) = ? [pid 5829] close(3 [pid 6092] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6091] <... close resumed>) = 0 [pid 6090] <... clone3 resumed> => {parent_tid=[6092]}, 88) = 6092 [pid 6085] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5829] <... close resumed>) = 0 [pid 6092] <... rseq resumed>) = 0 [pid 6090] rt_sigprocmask(SIG_SETMASK, [], [pid 6087] +++ killed by SIGSEGV +++ [pid 6086] +++ killed by SIGSEGV +++ [pid 6085] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [ 112.557825][ T6087] exFAT-fs (loop3): Filesystem has been set read-only [pid 5829] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6093 attached [pid 6092] set_robust_list(0x7f476942f9a0, 24 [pid 6091] mkdir("./file1", 0777 [pid 6090] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6088] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6085] <... futex resumed>) = 0 [pid 5832] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6086, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 6090] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] restart_syscall(<... resuming interrupted clone ...> [pid 6090] <... futex resumed>) = 0 [pid 6085] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5832] <... restart_syscall resumed>) = 0 [pid 5829] <... clone resumed>, child_tidptr=0x555561216690) = 6093 [pid 6093] set_robust_list(0x5555612166a0, 24 [pid 6092] <... set_robust_list resumed>) = 0 [pid 6090] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6085] <... mmap resumed>) = 0x7f47693ee000 [pid 6093] <... set_robust_list resumed>) = 0 [pid 6092] rt_sigprocmask(SIG_SETMASK, [], [pid 6088] <... futex resumed>) = 0 [pid 6093] chdir("./20" [pid 6092] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6085] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 5832] umount2("./21", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6093] <... chdir resumed>) = 0 [pid 6092] memfd_create("syzkaller", 0 [pid 6088] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6093] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 6092] <... memfd_create resumed>) = 3 [pid 6091] <... mkdir resumed>) = 0 [pid 6085] <... mprotect resumed>) = 0 [pid 5832] openat(AT_FDCWD, "./21", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6093] <... prctl resumed>) = 0 [pid 6092] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6085] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5832] <... openat resumed>) = 3 [pid 6093] setpgid(0, 0 [pid 6092] <... mmap resumed>) = 0x7f4761000000 [pid 6085] <... rt_sigprocmask resumed>[], 8) = 0 [pid 5832] newfstatat(3, "", [pid 6093] <... setpgid resumed>) = 0 [pid 6091] mount("/dev/loop4", "./file1", "exfat", 0, "" [pid 6085] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0} [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 6094 attached [pid 6093] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5832] getdents64(3, [pid 6094] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6085] <... clone3 resumed> => {parent_tid=[6094]}, 88) = 6094 [pid 5832] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6094] <... rseq resumed>) = 0 [pid 6093] <... openat resumed>) = 3 [pid 6085] rt_sigprocmask(SIG_SETMASK, [], [pid 5832] umount2("./21/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6094] set_robust_list(0x7f476940e9a0, 24 [pid 6093] write(3, "1000", 4 [pid 6092] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6085] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6094] <... set_robust_list resumed>) = 0 [pid 5832] <... umount2 resumed>) = 0 [pid 6093] <... write resumed>) = 4 [pid 6085] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] umount2("./21/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6093] close(3 [pid 6085] <... futex resumed>) = 0 [pid 5832] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6094] rt_sigprocmask(SIG_SETMASK, [], [pid 6093] <... close resumed>) = 0 [pid 6085] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5832] newfstatat(AT_FDCWD, "./21/file1", [pid 6094] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6093] symlink("/dev/binderfs", "./binderfs" [pid 6092] <... write resumed>) = 131072 [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6094] mkdir("./file2", 0777 [pid 6093] <... symlink resumed>) = 0 [pid 5832] umount2("./21/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5832] openat(AT_FDCWD, "./21/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 6093] write(1, "executing program\n", 18 [pid 6092] munmap(0x7f4761000000, 138412032executing program [pid 6093] <... write resumed>) = 18 [pid 6092] <... munmap resumed>) = 0 [pid 5832] newfstatat(4, "", [pid 6093] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6092] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 5832] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6093] <... futex resumed>) = 0 [pid 6092] <... openat resumed>) = 4 [pid 5832] getdents64(4, [pid 6093] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6092] ioctl(4, LOOP_SET_FD, 3 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 2 entries */, 32768) = 48 [pid 6093] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6085] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5832] getdents64(4, [pid 6093] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6085] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5832] <... getdents64 resumed>0x55556121f770 /* 0 entries */, 32768) = 0 [pid 5832] close(4 [pid 6085] <... futex resumed>) = 1 [pid 6088] <... futex resumed>) = 0 [pid 6088] ioctl(4, F2FS_IOC_SHUTDOWN, 0x200000000080 [pid 6085] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6093] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5832] <... close resumed>) = 0 [pid 6093] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5832] rmdir("./21/file1") = 0 [pid 5832] umount2("./21/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5832] newfstatat(AT_FDCWD, "./21/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6093] <... mmap resumed>) = 0x7f476940f000 [ 112.669169][ T6094] exFAT-fs (loop1): error, data size is invalid(9000) [ 112.699493][ T6092] loop2: detected capacity change from 0 to 256 [pid 5832] unlink("./21/binderfs" [pid 6093] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 5832] <... unlink resumed>) = 0 [pid 5832] getdents64(3, 0x555561217730 /* 0 entries */, 32768) = 0 [pid 5832] close(3) = 0 [pid 5832] rmdir("./21") = 0 [pid 5832] mkdir("./22", 0777) = 0 [pid 5832] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 6094] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 5832] ioctl(3, LOOP_CLR_FD) = 0 [pid 5832] close(3) = 0 [pid 5832] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 6094] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- ./strace-static-x86_64: Process 6095 attached [pid 6093] <... mprotect resumed>) = 0 [pid 5832] <... clone resumed>, child_tidptr=0x555561216690) = 6095 [pid 6093] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6093] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} [pid 6095] set_robust_list(0x5555612166a0, 24./strace-static-x86_64: Process 6096 attached [pid 6096] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053 [pid 6095] <... set_robust_list resumed>) = 0 [pid 6093] <... clone3 resumed> => {parent_tid=[6096]}, 88) = 6096 [pid 6092] <... ioctl resumed>) = 0 [pid 6093] rt_sigprocmask(SIG_SETMASK, [], [pid 6095] chdir("./22" [pid 6093] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6093] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6093] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6095] <... chdir resumed>) = 0 [pid 6095] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6095] setpgid(0, 0) = 0 [pid 6095] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6095] write(3, "1000", 4 [pid 6092] close(3 [pid 6095] <... write resumed>) = 4 [pid 6092] <... close resumed>) = 0 [pid 6095] close(3 [pid 6092] close(4 [pid 6095] <... close resumed>) = 0 [pid 6092] <... close resumed>) = 0 [pid 6095] symlink("/dev/binderfs", "./binderfs" [pid 6092] mkdir("./file1", 0777 [pid 6095] <... symlink resumed>) = 0 [pid 6092] <... mkdir resumed>) = 0 [pid 6096] <... rseq resumed>) = 0 [pid 6095] write(1, "executing program\n", 18executing program [pid 6096] set_robust_list(0x7f476942f9a0, 24 [pid 6095] <... write resumed>) = 18 [pid 6095] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6096] <... set_robust_list resumed>) = 0 [pid 6095] <... futex resumed>) = 0 [pid 6092] mount("/dev/loop2", "./file1", "exfat", 0, "" [pid 6096] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 112.733336][ T6094] exFAT-fs (loop1): Filesystem has been set read-only [ 112.760088][ T6091] exFAT-fs (loop4): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6096] memfd_create("syzkaller", 0 [pid 6095] rt_sigaction(SIGRT_1, {sa_handler=0x7f47694aa490, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f476949bdd0}, [pid 6096] <... memfd_create resumed>) = 3 [pid 6095] <... rt_sigaction resumed>NULL, 8) = 0 [pid 6096] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6095] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 6091] <... mount resumed>) = 0 [pid 6085] <... futex resumed>) = ? [pid 6096] <... mmap resumed>) = 0x7f4761000000 [pid 6095] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6095] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f476940f000 [pid 6096] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6095] mprotect(0x7f4769410000, 131072, PROT_READ|PROT_WRITE [pid 6094] +++ killed by SIGSEGV +++ [pid 6091] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 6096] <... write resumed>) = 131072 [pid 6095] <... mprotect resumed>) = 0 [pid 6091] <... openat resumed>) = 3 [pid 6088] <... ioctl resumed>) = ? [pid 6096] munmap(0x7f4761000000, 138412032 [pid 6091] chdir("./file1") = 0 [pid 6091] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 6095] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6091] <... openat resumed>) = -1 EBUSY (Device or resource busy) [pid 6095] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6095] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476942f990, parent_tid=0x7f476942f990, exit_signal=0, stack=0x7f476940f000, stack_size=0x20300, tls=0x7f476942f6c0} => {parent_tid=[6097]}, 88) = 6097 [pid 6095] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6095] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6095] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 6097 attached [pid 6096] <... munmap resumed>) = 0 [pid 6091] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6097] rseq(0x7f476942ffe0, 0x20, 0, 0x53053053) = 0 [pid 6097] set_robust_list(0x7f476942f9a0, 24) = 0 [pid 6097] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6097] memfd_create("syzkaller", 0 [pid 6091] <... futex resumed>) = 1 [pid 6089] <... futex resumed>) = 0 [pid 6089] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6097] <... memfd_create resumed>) = 3 [pid 6089] <... futex resumed>) = 0 [pid 6097] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6096] openat(AT_FDCWD, "/dev/loop0", O_RDWR [ 112.826623][ T6092] exFAT-fs (loop2): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [pid 6089] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6097] <... mmap resumed>) = 0x7f4761000000 [pid 6096] <... openat resumed>) = 4 [pid 6097] write(3, "\xeb\x76\x90\x45\x58\x46\x41\x54\x20\x20\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x08\x00\x00\x00\x88\x00\x00\x00\x0f\x00\x00\x00\x05\x00\x00\x00"..., 131072 [pid 6091] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6097] <... write resumed>) = 131072 [pid 6091] <... openat resumed>) = 4 [pid 6091] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6091] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6097] munmap(0x7f4761000000, 138412032) = 0 [pid 6097] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 6089] <... futex resumed>) = 0 [pid 6096] ioctl(4, LOOP_SET_FD, 3 [pid 6089] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6097] <... openat resumed>) = 4 [pid 6091] <... futex resumed>) = 0 [pid 6089] <... futex resumed>) = 1 [pid 6097] ioctl(4, LOOP_SET_FD, 3 [pid 6091] mkdir("./file2", 0777 [pid 6092] <... mount resumed>) = 0 [pid 6089] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6088] +++ killed by SIGSEGV +++ [pid 6085] +++ killed by SIGSEGV +++ [pid 6092] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5830] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6085, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=5 /* 0.05 s */} --- [pid 6092] chdir("./file1") = 0 [ 112.898429][ T6096] loop0: detected capacity change from 0 to 256 [ 112.898938][ T6097] loop3: detected capacity change from 0 to 256 [ 112.929285][ T6091] exFAT-fs (loop4): error, data size is invalid(9000) [pid 6092] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = -1 EBUSY (Device or resource busy) [pid 6092] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6092] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6090] <... futex resumed>) = 0 [pid 6090] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6092] <... futex resumed>) = 0 [pid 6090] <... futex resumed>) = 1 [pid 6092] openat(AT_FDCWD, "devices.list", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6092] futex(0x7f47695046cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6092] futex(0x7f47695046c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6090] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 6090] futex(0x7f47695046c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] umount2("./20", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6092] <... futex resumed>) = 0 [pid 6090] <... futex resumed>) = 1 [pid 6092] mkdir("./file2", 0777 [pid 6090] futex(0x7f47695046cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 5830] openat(AT_FDCWD, "./20", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 6096] <... ioctl resumed>) = 0 [pid 6096] close(3 [pid 6089] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 5830] <... openat resumed>) = 3 [pid 6096] <... close resumed>) = 0 [pid 6089] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] newfstatat(3, "", [pid 6096] close(4 [pid 6089] <... futex resumed>) = 0 [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 6096] <... close resumed>) = 0 [pid 5830] getdents64(3, [pid 6089] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 5830] <... getdents64 resumed>0x555561217730 /* 4 entries */, 32768) = 112 [pid 6096] mkdir("./file1", 0777 [pid 6089] <... mmap resumed>) = 0x7f47693ee000 [pid 5830] umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6097] <... ioctl resumed>) = 0 [pid 6096] <... mkdir resumed>) = 0 [pid 6097] close(3 [pid 6096] mount("/dev/loop0", "./file1", "exfat", 0, "" [pid 6089] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE [pid 6097] <... close resumed>) = 0 [pid 6097] close(4) = 0 [pid 6097] mkdir("./file1", 0777 [pid 6089] <... mprotect resumed>) = 0 [pid 6097] <... mkdir resumed>) = 0 [pid 6089] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6097] mount("/dev/loop3", "./file1", "exfat", 0, "" [pid 6089] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0}./strace-static-x86_64: Process 6098 attached => {parent_tid=[6098]}, 88) = 6098 [pid 6089] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6090] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 6090] futex(0x7f47695046dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6090] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f47693ee000 [pid 6090] mprotect(0x7f47693ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6090] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 112.953050][ T6092] exFAT-fs (loop2): error, data size is invalid(9000) [ 112.961111][ T6092] exFAT-fs (loop2): Filesystem has been set read-only [ 112.981268][ T6091] exFAT-fs (loop4): Filesystem has been set read-only [pid 6090] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f476940e990, parent_tid=0x7f476940e990, exit_signal=0, stack=0x7f47693ee000, stack_size=0x20300, tls=0x7f476940e6c0}./strace-static-x86_64: Process 6099 attached [pid 6098] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6092] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6089] futex(0x7f47695046d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 5830] <... umount2 resumed>) = 0 [pid 5830] umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 6098] <... rseq resumed>) = 0 [pid 6089] <... futex resumed>) = 0 [pid 6098] set_robust_list(0x7f476940e9a0, 24 [pid 6090] <... clone3 resumed> => {parent_tid=[6099]}, 88) = 6099 [pid 6089] futex(0x7f47695046dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 5830] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 6099] rseq(0x7f476940efe0, 0x20, 0, 0x53053053 [pid 6092] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6091] <... mkdir resumed>) = -1 EIO (Input/output error) [pid 6090] rt_sigprocmask(SIG_SETMASK, [], [pid 6091] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 6099] <... rseq resumed>) = ? [pid 6098] <... set_robust_list resumed>) = ? [pid 6090] <... rt_sigprocmask resumed> ) = ? [pid 6089] <... futex resumed>) = ? [pid 5830] newfstatat(AT_FDCWD, "./20/file1", [pid 6099] +++ killed by SIGSEGV +++ [pid 6098] +++ killed by SIGSEGV +++ [pid 5830] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 6091] +++ killed by SIGSEGV +++ [pid 6089] +++ killed by SIGSEGV +++ [pid 5830] umount2("./20/file1", MNT_FORCE|UMOUNT_NOFOLLOW [pid 5833] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6089, si_uid=0, si_status=SIGSEGV, si_utime=0, si_stime=2 /* 0.02 s */} --- [ 113.037555][ T6097] exFAT-fs (loop3): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 113.091826][ T10] ------------[ cut here ]------------ [ 113.101134][ T10] WARNING: CPU: 0 PID: 10 at kernel/rcu/sync.c:177 rcu_sync_dtor+0xcd/0x180 [ 113.115990][ T10] Modules linked in: [ 113.123044][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-rc6-syzkaller-00085-gc94d59a126cb #0 PREEMPT(full) [ 113.140523][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 113.157357][ T10] Workqueue: events destroy_super_work [ 113.170161][ T10] RIP: 0010:rcu_sync_dtor+0xcd/0x180 [ 113.177101][ T10] Code: 18 e8 27 c3 00 00 43 0f b6 44 25 00 84 c0 0f 85 82 00 00 00 83 3b 00 75 1f 5b 41 5c 41 5d 41 5e 41 5f 5d e9 c5 75 ab 09 cc 90 <0f> 0b 90 e9 66 ff ff ff 90 0f 0b 90 eb 8a 90 0f 0b 90 eb db 89 d9 [ 113.211869][ T10] RSP: 0018:ffffc900000f7a88 EFLAGS: 00010246 [ 113.219404][ T10] RAX: 0000000000000002 RBX: ffff88807f6a2350 RCX: 164d0da3e71d3700 [ 113.234206][ T10] RDX: 0000000000000000 RSI: ffffffff8bc104c0 RDI: ffff88807f6a2350 [ 113.235267][ T6100] exFAT-fs (loop3): error, data size is invalid(9000) [ 113.245284][ T10] RBP: 00000000000001a6 R08: ffffffff8dde112f R09: 1ffffffff1bbc225 [ 113.245337][ T10] R10: dffffc0000000000 R11: fffffbfff1bbc226 R12: dffffc0000000000 [ 113.245351][ T10] R13: 1ffff1100fed446a R14: ffff88807f6a2350 R15: dffffc0000000000 [ 113.245366][ T10] FS: 0000000000000000(0000) GS:ffff8881260fb000(0000) knlGS:0000000000000000 [ 113.245382][ T10] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.245395][ T10] CR2: 00007ffc8965cf6c CR3: 0000000023e1e000 CR4: 00000000003526f0 [ 113.308806][ T6096] exFAT-fs (loop0): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d1950c, utbl_chksum : 0xe619d30d) [ 113.318946][ T10] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 113.382482][ T10] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 113.399568][ T10] Call Trace: [ 113.403129][ T6100] exFAT-fs (loop3): Filesystem has been set read-only [ 113.405428][ T10] [ 113.420173][ T10] percpu_free_rwsem+0x40/0x80 [ 113.433701][ T10] destroy_super_work+0xee/0x130 [ 113.439652][ T10] ? process_scheduled_works+0x9ec/0x17a0 [ 113.451549][ T10] process_scheduled_works+0xadb/0x17a0 [ 113.457813][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 113.467437][ T10] worker_thread+0x8a0/0xda0 [ 113.476137][ T10] kthread+0x70e/0x8a0 [ 113.484665][ T10] ? __pfx_worker_thread+0x10/0x10 [ 113.495796][ T10] ? __pfx_kthread+0x10/0x10 [ 113.503413][ T10] ? __pfx_kthread+0x10/0x10 [ 113.516057][ T10] ? _raw_spin_unlock_irq+0x23/0x50 [ 113.524222][ T10] ? lockdep_hardirqs_on+0x9c/0x150 [ 113.535505][ T10] ? __pfx_kthread+0x10/0x10 [ 113.541269][ T10] ret_from_fork+0x4b/0x80 [ 113.551780][ T10] ? __pfx_kthread+0x10/0x10 [ 113.556570][ T10] ret_from_fork_asm+0x1a/0x30 [ 113.566690][ T10] [ 113.572479][ T10] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 113.585333][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-rc6-syzkaller-00085-gc94d59a126cb #0 PREEMPT(full) [ 113.612653][ T10] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 113.630053][ T10] Workqueue: events destroy_super_work [ 113.636442][ T10] Call Trace: [ 113.640019][ T10] [ 113.651614][ T10] dump_stack_lvl+0x99/0x250 [ 113.656894][ T10] ? __asan_memcpy+0x40/0x70 [ 113.669896][ T10] ? __pfx_dump_stack_lvl+0x10/0x10 [ 113.676011][ T10] ? __pfx__printk+0x10/0x10 [ 113.680961][ T10] panic+0x2db/0x790 [ 113.685254][ T10] ? __pfx_panic+0x10/0x10 [ 113.693114][ T10] ? show_trace_log_lvl+0x4fb/0x550 [ 113.699406][ T10] ? ret_from_fork_asm+0x1a/0x30 [ 113.709751][ T10] __warn+0x31b/0x4b0 [ 113.715204][ T10] ? rcu_sync_dtor+0xcd/0x180 [ 113.720024][ T10] ? rcu_sync_dtor+0xcd/0x180 [ 113.728446][ T10] report_bug+0x2be/0x4f0 [ 113.733439][ T10] ? rcu_sync_dtor+0xcd/0x180 [ 113.742477][ T10] ? rcu_sync_dtor+0xcd/0x180 [ 113.750841][ T10] ? rcu_sync_dtor+0xcf/0x180 [ 113.755955][ T10] handle_bug+0x84/0x160 [ 113.766432][ T10] exc_invalid_op+0x1a/0x50 [ 113.772674][ T10] asm_exc_invalid_op+0x1a/0x20 [ 113.778045][ T10] RIP: 0010:rcu_sync_dtor+0xcd/0x180 [ 113.787391][ T10] Code: 18 e8 27 c3 00 00 43 0f b6 44 25 00 84 c0 0f 85 82 00 00 00 83 3b 00 75 1f 5b 41 5c 41 5d 41 5e 41 5f 5d e9 c5 75 ab 09 cc 90 <0f> 0b 90 e9 66 ff ff ff 90 0f 0b 90 eb 8a 90 0f 0b 90 eb db 89 d9 [ 113.814967][ T10] RSP: 0018:ffffc900000f7a88 EFLAGS: 00010246 [ 113.826589][ T10] RAX: 0000000000000002 RBX: ffff88807f6a2350 RCX: 164d0da3e71d3700 [ 113.838035][ T10] RDX: 0000000000000000 RSI: ffffffff8bc104c0 RDI: ffff88807f6a2350 [ 113.851768][ T10] RBP: 00000000000001a6 R08: ffffffff8dde112f R09: 1ffffffff1bbc225 [ 113.863286][ T10] R10: dffffc0000000000 R11: fffffbfff1bbc226 R12: dffffc0000000000 [ 113.876011][ T10] R13: 1ffff1100fed446a R14: ffff88807f6a2350 R15: dffffc0000000000 [ 113.889793][ T10] ? destroy_super_work+0xe2/0x130 [ 113.896033][ T10] percpu_free_rwsem+0x40/0x80 [ 113.906970][ T10] destroy_super_work+0xee/0x130 [ 113.914126][ T10] ? process_scheduled_works+0x9ec/0x17a0 [ 113.920585][ T10] process_scheduled_works+0xadb/0x17a0 [ 113.935689][ T10] ? __pfx_process_scheduled_works+0x10/0x10 [ 113.949276][ T10] worker_thread+0x8a0/0xda0 [ 113.956085][ T10] kthread+0x70e/0x8a0 [ 113.965673][ T10] ? __pfx_worker_thread+0x10/0x10 [ 113.973967][ T10] ? __pfx_kthread+0x10/0x10 [ 113.982315][ T10] ? __pfx_kthread+0x10/0x10 [ 113.993145][ T10] ? _raw_spin_unlock_irq+0x23/0x50 [ 113.999879][ T10] ? lockdep_hardirqs_on+0x9c/0x150 [ 114.011691][ T10] ? __pfx_kthread+0x10/0x10 [ 114.018146][ T10] ret_from_fork+0x4b/0x80 [ 114.033604][ T10] ? __pfx_kthread+0x10/0x10 [ 114.038954][ T10] ret_from_fork_asm+0x1a/0x30 [ 114.048610][ T10] [ 114.054215][ T10] Kernel Offset: disabled [ 114.059434][ T10] Rebooting in 86400 seconds..