./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1725130023 <...> Warning: Permanently added '10.128.1.26' (ED25519) to the list of known hosts. execve("./syz-executor1725130023", ["./syz-executor1725130023"], 0x7ffe94352a60 /* 10 vars */) = 0 brk(NULL) = 0x555556cc7000 brk(0x555556cc7d40) = 0x555556cc7d40 arch_prctl(ARCH_SET_FS, 0x555556cc73c0) = 0 set_tid_address(0x555556cc7690) = 295 set_robust_list(0x555556cc76a0, 24) = 0 rseq(0x555556cc7ce0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1725130023", 4096) = 28 getrandom("\xb0\x6c\x55\x60\xc9\x0a\x97\x32", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556cc7d40 brk(0x555556ce8d40) = 0x555556ce8d40 brk(0x555556ce9000) = 0x555556ce9000 mprotect(0x7f622052b000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 296 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 297 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 298 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 299 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 300 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 301 ./strace-static-x86_64: Process 301 attached [pid 301] set_robust_list(0x555556cc76a0, 24) = 0 [pid 301] mkdir("./syzkaller.bzF58U", 0700) = 0 ./strace-static-x86_64: Process 296 attached [pid 296] set_robust_list(0x555556cc76a0, 24) = 0 [pid 296] mkdir("./syzkaller.sY6u5M", 0700) = 0 [pid 301] chmod("./syzkaller.bzF58U", 0777) = 0 [pid 296] chmod("./syzkaller.sY6u5M", 0777) = 0 [pid 301] chdir("./syzkaller.bzF58U") = 0 [pid 296] chdir("./syzkaller.sY6u5M" [pid 301] mkdir("./0", 0777 [pid 296] <... chdir resumed>) = 0 [pid 296] mkdir("./0", 0777 [pid 301] <... mkdir resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 296] <... openat resumed>) = 3 [pid 301] <... openat resumed>) = 3 [pid 301] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 301] close(3) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 303 [pid 301] <... clone resumed>, child_tidptr=0x555556cc7690) = 302 ./strace-static-x86_64: Process 302 attached [pid 302] set_robust_list(0x555556cc76a0, 24) = 0 [pid 302] chdir("./0") = 0 [pid 302] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 302] setpgid(0, 0) = 0 [pid 302] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 302] write(3, "1000", 4) = 4 [pid 302] close(3) = 0 [pid 302] symlink("/dev/binderfs", "./binderfs") = 0 [pid 302] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 302] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 302] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 302] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 302] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 302] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[304]}, 88) = 304 [pid 302] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 302] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 302] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 302] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 302] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[305]}, 88) = 305 [pid 302] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 302] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 305 attached [pid 305] set_robust_list(0x7f62204449a0, 24) = 0 [pid 305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 305] creat("./bus", 000) = 3 [pid 305] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = 0 [pid 302] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... futex resumed>) = 1 [pid 305] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 305] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = 0 [pid 302] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... futex resumed>) = 1 [pid 305] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 305] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = 0 [pid 302] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... futex resumed>) = 1 [pid 305] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE) = 5 [pid 305] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = 0 [pid 302] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 302] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... futex resumed>) = 1 [pid 305] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0) = 0x20000000 [pid 305] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 302] <... futex resumed>) = 0 [pid 302] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 305] <... futex resumed>) = 1 [pid 305] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- ./strace-static-x86_64: Process 304 attached [pid 305] +++ killed by SIGBUS +++ [pid 304] +++ killed by SIGBUS +++ [pid 302] +++ killed by SIGBUS +++ [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=302, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 301] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 301] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 301] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 301] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 301] getdents64(3, 0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 301] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 297 attached [pid 297] set_robust_list(0x555556cc76a0, 24) = 0 [pid 301] <... umount2 resumed>) = 0 [pid 301] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 301] newfstatat(AT_FDCWD, "./0/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] unlink("./0/bus") = 0 [pid 301] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 301] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] unlink("./0/binderfs") = 0 [pid 301] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 301] close(3) = 0 [pid 301] rmdir("./0") = 0 [pid 301] mkdir("./1", 0777) = 0 [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 301] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 301] close(3) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 306 [pid 297] mkdir("./syzkaller.9gSDIa", 0700) = 0 [pid 297] chmod("./syzkaller.9gSDIa", 0777) = 0 [pid 297] chdir("./syzkaller.9gSDIa") = 0 [pid 297] mkdir("./0", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3./strace-static-x86_64: Process 303 attached ) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 308 ./strace-static-x86_64: Process 306 attached [pid 306] set_robust_list(0x555556cc76a0, 24) = 0 [pid 303] set_robust_list(0x555556cc76a0, 24 [pid 306] chdir("./1") = 0 [pid 306] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 306] setpgid(0, 0) = 0 [pid 306] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 306] write(3, "1000", 4) = 4 [pid 306] close(3) = 0 [pid 306] symlink("/dev/binderfs", "./binderfs") = 0 [pid 306] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 306] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 306] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], ./strace-static-x86_64: Process 299 attached ./strace-static-x86_64: Process 300 attached ./strace-static-x86_64: Process 298 attached [pid 303] <... set_robust_list resumed>) = 0 [pid 306] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 23.008003][ T30] audit: type=1400 audit(1694881038.096:66): avc: denied { execmem } for pid=295 comm="syz-executor172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [pid 306] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 308 attached [pid 303] chdir("./0" [pid 300] set_robust_list(0x555556cc76a0, 24 [pid 306] <... mmap resumed>) = 0x7f6220445000 [pid 299] set_robust_list(0x555556cc76a0, 24 [pid 298] set_robust_list(0x555556cc76a0, 24 [pid 303] <... chdir resumed>) = 0 [pid 300] <... set_robust_list resumed>) = 0 [pid 299] <... set_robust_list resumed>) = 0 [pid 298] <... set_robust_list resumed>) = 0 [pid 303] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 308] set_robust_list(0x555556cc76a0, 24 [pid 306] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 300] mkdir("./syzkaller.Zpv55J", 0700 [pid 299] mkdir("./syzkaller.4NT5vc", 0700 [pid 308] <... set_robust_list resumed>) = 0 [pid 306] <... mprotect resumed>) = 0 [pid 303] <... prctl resumed>) = 0 [pid 298] mkdir("./syzkaller.4RDDfu", 0700 [pid 308] chdir("./0" [pid 306] rt_sigprocmask(SIG_BLOCK, ~[], [pid 303] setpgid(0, 0 [pid 299] <... mkdir resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 308] <... chdir resumed>) = 0 [pid 306] <... rt_sigprocmask resumed>[], 8) = 0 [pid 303] <... setpgid resumed>) = 0 [pid 300] <... mkdir resumed>) = 0 [pid 298] chmod("./syzkaller.4RDDfu", 0777 [pid 299] chmod("./syzkaller.4NT5vc", 0777 [pid 303] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 300] chmod("./syzkaller.Zpv55J", 0777 [pid 298] <... chmod resumed>) = 0 [pid 299] <... chmod resumed>) = 0 [pid 308] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 306] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 303] <... openat resumed>) = 3 [pid 300] <... chmod resumed>) = 0 [pid 299] chdir("./syzkaller.4NT5vc" [pid 298] chdir("./syzkaller.4RDDfu" [pid 303] write(3, "1000", 4 [pid 300] chdir("./syzkaller.Zpv55J" [pid 299] <... chdir resumed>) = 0 [pid 303] <... write resumed>) = 4 [pid 300] <... chdir resumed>) = 0 [pid 298] <... chdir resumed>) = 0 [pid 308] <... prctl resumed>) = 0 [pid 303] close(3 [pid 300] mkdir("./0", 0777 [pid 299] mkdir("./0", 0777 [pid 298] mkdir("./0", 0777 [pid 303] <... close resumed>) = 0 [pid 308] setpgid(0, 0 [pid 306] <... clone3 resumed> => {parent_tid=[311]}, 88) = 311 [pid 303] symlink("/dev/binderfs", "./binderfs" [pid 300] <... mkdir resumed>) = 0 [pid 308] <... setpgid resumed>) = 0 [pid 306] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... mkdir resumed>) = 0 [pid 303] <... symlink resumed>) = 0 [pid 308] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 306] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 303] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 299] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 308] <... openat resumed>) = 3 [pid 306] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] <... futex resumed>) = 0 [pid 300] <... openat resumed>) = 3 [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 298] <... openat resumed>) = 3 [pid 303] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 300] ioctl(3, LOOP_CLR_FD [pid 303] <... rt_sigaction resumed>NULL, 8) = 0 [pid 299] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 308] write(3, "1000", 4 [pid 306] <... futex resumed>) = 0 [pid 303] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 300] close(3 [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 308] <... write resumed>) = 4 [pid 306] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] <... close resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 308] close(3 [pid 306] <... futex resumed>) = 0 [pid 308] <... close resumed>) = 0 [pid 306] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] symlink("/dev/binderfs", "./binderfs" [pid 306] <... mmap resumed>) = 0x7f6220424000 [pid 308] <... symlink resumed>) = 0 [pid 306] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 308] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... mprotect resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 306] rt_sigprocmask(SIG_BLOCK, ~[], [pid 303] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] close(3 [pid 298] close(3 [pid 308] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 306] <... rt_sigprocmask resumed>[], 8) = 0 [pid 308] <... rt_sigaction resumed>NULL, 8) = 0 [pid 306] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 303] <... mmap resumed>) = 0x7f6220445000 [pid 299] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 308] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 303] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 306] <... clone3 resumed> => {parent_tid=[313]}, 88) = 313 [pid 303] <... mprotect resumed>) = 0 [pid 308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 306] rt_sigprocmask(SIG_SETMASK, [], [pid 308] <... mmap resumed>) = 0x7f6220445000 [pid 306] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 303] rt_sigprocmask(SIG_BLOCK, ~[], [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 312 [pid 299] <... clone resumed>, child_tidptr=0x555556cc7690) = 314 [pid 308] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 306] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 315 [pid 308] <... mprotect resumed>) = 0 [pid 306] <... futex resumed>) = 0 [pid 303] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [pid 306] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] <... rt_sigprocmask resumed>[], 8) = 0 [pid 303] <... clone3 resumed> => {parent_tid=[316]}, 88) = 316 [pid 308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 308] <... clone3 resumed> => {parent_tid=[317]}, 88) = 317 [pid 308] rt_sigprocmask(SIG_SETMASK, [], [pid 303] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 303] <... futex resumed>) = 0 [pid 308] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... futex resumed>) = 0 [pid 303] <... futex resumed>) = 0 [pid 308] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] <... futex resumed>) = 0 [pid 303] <... mmap resumed>) = 0x7f6220424000 [pid 308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 303] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 308] <... mmap resumed>) = 0x7f6220424000 [pid 303] <... mprotect resumed>) = 0 [pid 308] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 303] rt_sigprocmask(SIG_BLOCK, ~[], [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [pid 303] <... rt_sigprocmask resumed>[], 8) = 0 [pid 308] <... rt_sigprocmask resumed>[], 8) = 0 [pid 303] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[319]}, 88) = 319 [pid 303] <... clone3 resumed> => {parent_tid=[318]}, 88) = 318 [pid 308] rt_sigprocmask(SIG_SETMASK, [], [pid 303] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 311 attached [pid 308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 303] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 308] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... futex resumed>) = 0 [pid 311] set_robust_list(0x7f62204659a0, 24 [pid 303] <... futex resumed>) = 0 [pid 311] <... set_robust_list resumed>) = 0 [pid 308] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 303] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 319 attached ./strace-static-x86_64: Process 317 attached ./strace-static-x86_64: Process 316 attached [pid 311] memfd_create("syzkaller", 0) = 3 ./strace-static-x86_64: Process 315 attached ./strace-static-x86_64: Process 314 attached [pid 311] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0./strace-static-x86_64: Process 313 attached [pid 319] set_robust_list(0x7f62204449a0, 24 [pid 317] set_robust_list(0x7f62204659a0, 24 [pid 316] set_robust_list(0x7f62204659a0, 24 [pid 315] set_robust_list(0x555556cc76a0, 24 [pid 314] set_robust_list(0x555556cc76a0, 24 [pid 311] <... mmap resumed>) = 0x7f6218024000 ./strace-static-x86_64: Process 312 attached [pid 319] <... set_robust_list resumed>) = 0 [pid 317] <... set_robust_list resumed>) = 0 [pid 316] <... set_robust_list resumed>) = 0 [pid 313] set_robust_list(0x7f62204449a0, 24 [pid 315] <... set_robust_list resumed>) = 0 [pid 315] chdir("./0" [pid 314] <... set_robust_list resumed>) = 0 [pid 319] rt_sigprocmask(SIG_SETMASK, [], [pid 317] rt_sigprocmask(SIG_SETMASK, [], [pid 316] rt_sigprocmask(SIG_SETMASK, [], [pid 315] <... chdir resumed>) = 0 [pid 314] chdir("./0" [pid 313] <... set_robust_list resumed>) = 0 [pid 312] set_robust_list(0x555556cc76a0, 24 [pid 315] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 314] <... chdir resumed>) = 0 [pid 311] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 318 attached [pid 315] <... prctl resumed>) = 0 [pid 314] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 319] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 317] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 316] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 315] setpgid(0, 0 [pid 314] <... prctl resumed>) = 0 [pid 313] rt_sigprocmask(SIG_SETMASK, [], [pid 312] <... set_robust_list resumed>) = 0 [pid 319] creat("./bus", 000 [pid 318] set_robust_list(0x7f62204449a0, 24 [pid 317] memfd_create("syzkaller", 0 [pid 316] memfd_create("syzkaller", 0 [pid 315] <... setpgid resumed>) = 0 [pid 314] setpgid(0, 0 [pid 313] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 312] chdir("./0" [pid 319] <... creat resumed>) = 3 [pid 317] <... memfd_create resumed>) = 4 [pid 316] <... memfd_create resumed>) = 3 [pid 313] creat("./bus", 000 [pid 312] <... chdir resumed>) = 0 [pid 311] <... write resumed>) = 262144 [pid 319] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... set_robust_list resumed>) = 0 [pid 317] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 316] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 315] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 314] <... setpgid resumed>) = 0 [pid 313] <... creat resumed>) = 4 [pid 312] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 319] <... futex resumed>) = 1 [pid 317] <... mmap resumed>) = 0x7f6218024000 [pid 316] <... mmap resumed>) = 0x7f6218024000 [pid 313] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... prctl resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 319] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 318] rt_sigprocmask(SIG_SETMASK, [], [ 23.052178][ T30] audit: type=1400 audit(1694881038.096:67): avc: denied { read write } for pid=296 comm="syz-executor172" name="loop0" dev="devtmpfs" ino=112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 317] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 316] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 315] <... openat resumed>) = 3 [pid 314] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 313] <... futex resumed>) = 1 [pid 312] setpgid(0, 0 [pid 311] munmap(0x7f6218024000, 262144 [pid 308] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 0 [pid 319] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 318] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 317] <... write resumed>) = 262144 [pid 316] <... write resumed>) = 262144 [pid 315] write(3, "1000", 4 [pid 314] <... openat resumed>) = 3 [pid 313] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 312] <... setpgid resumed>) = 0 [pid 311] <... munmap resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 306] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 319] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 318] creat("./bus", 000 [pid 317] munmap(0x7f6218024000, 262144 [pid 316] munmap(0x7f6218024000, 262144 [pid 315] <... write resumed>) = 4 [pid 314] write(3, "1000", 4 [pid 313] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 312] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 311] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 308] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 0 [pid 319] <... mount resumed>) = 0 [pid 318] <... creat resumed>) = 4 [pid 317] <... munmap resumed>) = 0 [pid 316] <... munmap resumed>) = 0 [pid 315] close(3 [pid 314] <... write resumed>) = 4 [pid 313] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 312] <... openat resumed>) = 3 [pid 311] <... openat resumed>) = 5 [pid 306] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 317] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 316] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 315] <... close resumed>) = 0 [pid 314] close(3 [pid 313] <... mount resumed>) = 0 [pid 312] write(3, "1000", 4 [ 23.121309][ T30] audit: type=1400 audit(1694881038.096:68): avc: denied { open } for pid=296 comm="syz-executor172" path="/dev/loop0" dev="devtmpfs" ino=112 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 23.142598][ T311] loop5: detected capacity change from 0 to 512 [pid 311] ioctl(5, LOOP_SET_FD, 3 [pid 319] <... futex resumed>) = 1 [pid 318] <... futex resumed>) = 1 [pid 317] <... openat resumed>) = 5 [pid 316] <... openat resumed>) = 5 [pid 315] symlink("/dev/binderfs", "./binderfs" [pid 314] <... close resumed>) = 0 [pid 313] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... write resumed>) = 4 [pid 308] <... futex resumed>) = 0 [pid 303] <... futex resumed>) = 0 [pid 318] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 315] <... symlink resumed>) = 0 [pid 314] symlink("/dev/binderfs", "./binderfs" [pid 303] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 315] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] <... symlink resumed>) = 0 [pid 303] <... futex resumed>) = 0 [pid 318] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 315] <... futex resumed>) = 0 [pid 314] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 318] <... mount resumed>) = 0 [pid 315] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 314] <... futex resumed>) = 0 [pid 318] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... rt_sigaction resumed>NULL, 8) = 0 [pid 314] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 318] <... futex resumed>) = 1 [pid 315] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 314] <... rt_sigaction resumed>NULL, 8) = 0 [pid 303] <... futex resumed>) = 0 [pid 318] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 315] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 314] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 303] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 315] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 314] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 303] <... futex resumed>) = 0 [pid 318] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 315] <... mmap resumed>) = 0x7f6220445000 [pid 314] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 303] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 318] <... open resumed>) = 6 [pid 315] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 314] <... mmap resumed>) = 0x7f6220445000 [pid 318] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... mprotect resumed>) = 0 [pid 314] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 318] <... futex resumed>) = 1 [pid 315] rt_sigprocmask(SIG_BLOCK, ~[], [pid 314] <... mprotect resumed>) = 0 [pid 303] <... futex resumed>) = 0 [pid 318] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 315] <... rt_sigprocmask resumed>[], 8) = 0 [pid 314] rt_sigprocmask(SIG_BLOCK, ~[], [pid 303] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 315] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 314] <... rt_sigprocmask resumed>[], 8) = 0 [pid 303] <... futex resumed>) = 0 [pid 318] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 314] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 303] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 318] <... socket resumed>) = 7 [pid 315] <... clone3 resumed> => {parent_tid=[320]}, 88) = 320 [pid 318] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] rt_sigprocmask(SIG_SETMASK, [], [pid 314] <... clone3 resumed> => {parent_tid=[321]}, 88) = 321 [pid 318] <... futex resumed>) = 1 [pid 315] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 314] rt_sigprocmask(SIG_SETMASK, [], [pid 303] <... futex resumed>) = 0 [pid 318] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 315] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 303] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 315] <... futex resumed>) = 0 [pid 314] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 303] <... futex resumed>) = 0 [pid 318] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 315] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] <... futex resumed>) = 0 [pid 303] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 318] <... mmap resumed>) = 0x20000000 [pid 315] <... futex resumed>) = 0 [pid 314] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 314] <... futex resumed>) = 0 [pid 318] <... futex resumed>) = 1 [pid 315] <... mmap resumed>) = 0x7f6220424000 [pid 314] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 303] <... futex resumed>) = 0 [pid 318] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 315] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 314] <... mmap resumed>) = 0x7f6220424000 [pid 303] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 315] <... mprotect resumed>) = 0 [pid 314] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 311] <... ioctl resumed>) = 0 [pid 303] <... futex resumed>) = 0 [pid 318] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 315] rt_sigprocmask(SIG_BLOCK, ~[], [pid 314] <... mprotect resumed>) = 0 [pid 311] close(3 [pid 303] close(3 [pid 315] <... rt_sigprocmask resumed>[], 8) = 0 [pid 314] rt_sigprocmask(SIG_BLOCK, ~[], [pid 311] <... close resumed>) = 0 [pid 315] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 314] <... rt_sigprocmask resumed>[], 8) = 0 [pid 314] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 311] mkdir("./file0", 0777 [pid 315] <... clone3 resumed> => {parent_tid=[322]}, 88) = 322 [pid 311] <... mkdir resumed>) = 0 [pid 315] rt_sigprocmask(SIG_SETMASK, [], [pid 314] <... clone3 resumed> => {parent_tid=[323]}, 88) = 323 [pid 311] mount("/dev/loop5", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 315] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 314] rt_sigprocmask(SIG_SETMASK, [], [pid 315] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 315] <... futex resumed>) = 0 [pid 314] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 314] <... futex resumed>) = 0 [pid 314] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 320 attached [pid 320] set_robust_list(0x7f62204659a0, 24) = 0 [pid 320] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 320] memfd_create("syzkaller", 0) = 3 [pid 320] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218024000 ./strace-static-x86_64: Process 322 attached [pid 322] set_robust_list(0x7f62204449a0, 24) = 0 [pid 322] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 322] creat("./bus", 000 [pid 320] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 322] <... creat resumed>) = 4 ./strace-static-x86_64: Process 323 attached [pid 323] set_robust_list(0x7f62204449a0, 24) = 0 [pid 323] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 323] creat("./bus", 000) = 3 [pid 322] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... futex resumed>) = 0 [pid 315] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 315] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 322] <... futex resumed>) = 1 [pid 322] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 322] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 315] <... futex resumed>) = 0 [pid 315] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 315] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 322] <... futex resumed>) = 1 [pid 323] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 323] <... futex resumed>) = 1 [pid 322] <... open resumed>) = 5 [pid 314] <... futex resumed>) = 0 [pid 323] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 322] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... mount resumed>) = 0 [pid 322] <... futex resumed>) = 1 [pid 315] <... futex resumed>) = 0 [pid 314] <... futex resumed>) = 0 [pid 323] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 315] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 323] <... futex resumed>) = 0 [pid 322] <... socket resumed>) = 6 [pid 320] <... write resumed>) = 262144 [pid 315] <... futex resumed>) = 0 [pid 314] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 323] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 322] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 320] munmap(0x7f6218024000, 262144 [pid 315] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 314] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 322] <... futex resumed>) = 0 [pid 320] <... munmap resumed>) = 0 [pid 315] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 314] <... futex resumed>) = 0 [pid 323] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 322] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 320] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 315] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 323] <... open resumed>) = 4 [pid 322] <... mmap resumed>) = 0x20000000 [pid 320] <... openat resumed>) = 7 [pid 315] <... futex resumed>) = 0 [pid 323] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 320] ioctl(7, LOOP_SET_FD, 3 [pid 315] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 321 attached [pid 323] <... futex resumed>) = 1 [pid 322] <... futex resumed>) = 0 [pid 319] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 317] ioctl(5, LOOP_SET_FD, 4 [pid 315] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [ 23.146096][ T30] audit: type=1400 audit(1694881038.096:69): avc: denied { ioctl } for pid=301 comm="syz-executor172" path="/dev/loop5" dev="devtmpfs" ino=117 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 23.169807][ T320] loop2: detected capacity change from 0 to 512 [ 23.184006][ T30] audit: type=1400 audit(1694881038.106:70): avc: denied { mounton } for pid=302 comm="syz-executor172" path="/root/syzkaller.bzF58U/0/bus" dev="sda1" ino=1932 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=file permissive=1 [ 23.184717][ T322] blk_update_request: I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 3 prio class 0 [pid 314] <... futex resumed>) = 0 [pid 313] <... futex resumed>) = 1 [pid 312] close(3 [pid 308] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 0 [pid 323] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 321] set_robust_list(0x7f62204659a0, 24 [pid 319] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 317] <... ioctl resumed>) = 0 [pid 316] +++ killed by SIGBUS +++ [pid 315] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 314] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 315] <... futex resumed>) = 0 [pid 314] <... futex resumed>) = 0 [pid 323] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 314] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 323] <... socket resumed>) = 5 [pid 323] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 314] <... futex resumed>) = 0 [pid 323] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 314] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 314] <... futex resumed>) = 0 [pid 323] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0 [pid 314] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 323] <... mmap resumed>) = 0x20000000 [pid 323] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 314] <... futex resumed>) = 0 [pid 323] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 314] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 314] <... futex resumed>) = 0 [pid 323] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 314] read(542316032, [pid 320] <... ioctl resumed>) = 0 [pid 320] close(3) = 0 [pid 320] mkdir(0x20000000, 0777) = -1 ENOENT (No such file or directory) [pid 320] mount("/dev/loop2", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"...) = -1 ENOENT (No such file or directory) [pid 320] ioctl(7, LOOP_CLR_FD) = 0 [pid 320] close(7) = 0 [pid 320] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 320] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 322] memfd_create("syzkaller", 0) = 3 [pid 322] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f620fc64000 [pid 322] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536) = 65536 [pid 322] munmap(0x7f620fc64000, 65536) = 0 [pid 322] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 313] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 312] <... close resumed>) = 0 [pid 312] symlink("/dev/binderfs", "./binderfs") = 0 [pid 312] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 312] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 312] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 319] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 312] <... mmap resumed>) = 0x7f6220445000 [pid 308] <... futex resumed>) = 0 [pid 306] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 312] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 312] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[324]}, 88) = 324 [pid 312] rt_sigprocmask(SIG_SETMASK, [], [pid 318] +++ killed by SIGBUS +++ [pid 312] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 303] +++ killed by SIGBUS +++ [pid 317] close(4 [pid 321] <... set_robust_list resumed>) = ? [pid 319] <... open resumed>) = 6 [pid 317] <... close resumed>) = 0 [pid 313] <... futex resumed>) = 0 [pid 312] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 1 [pid 313] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 312] <... futex resumed>) = 0 [pid 313] <... open resumed>) = 3 [pid 312] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... futex resumed>) = 0 [pid 313] <... futex resumed>) = 0 [pid 312] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 313] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 312] <... mmap resumed>) = 0x7f6220424000 [pid 312] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 312] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 312] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[327]}, 88) = 327 [pid 312] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 312] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 322] <... openat resumed>) = 7 [pid 322] ioctl(7, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 322] ioctl(7, LOOP_CLR_FD) = 0 ./strace-static-x86_64: Process 327 attached [pid 327] set_robust_list(0x7f62204449a0, 24) = 0 [pid 327] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 327] creat("./bus", 000 [pid 322] ioctl(7, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 322] close(7) = 0 [pid 322] close(3) = 0 [pid 322] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 322] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 315] exit_group(0 [pid 320] <... futex resumed>) = ? [pid 315] <... exit_group resumed>) = ? [pid 320] +++ exited with 0 +++ [pid 322] <... futex resumed>) = ? [ 23.208534][ T317] loop1: detected capacity change from 0 to 512 [ 23.225736][ T30] audit: type=1400 audit(1694881038.106:71): avc: denied { create } for pid=302 comm="syz-executor172" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [pid 321] +++ killed by SIGBUS +++ [pid 319] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 317] mkdir("./file0", 0777 [pid 308] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 306] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=303, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 323] +++ killed by SIGBUS +++ [pid 314] +++ killed by SIGBUS +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=314, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 319] <... futex resumed>) = 0 [pid 317] <... mkdir resumed>) = 0 [pid 308] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 299] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 327] <... creat resumed>) = 3 [pid 327] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... futex resumed>) = 0 [pid 312] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] <... futex resumed>) = 1 [pid 327] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 327] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 312] <... futex resumed>) = 0 [pid 312] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 327] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 312] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] <... open resumed>) = 4 [pid 327] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 312] <... futex resumed>) = 0 [pid 327] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 312] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... socket resumed>) = 5 [pid 312] <... futex resumed>) = 0 [pid 327] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] <... futex resumed>) = 0 [pid 312] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 327] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0 [pid 312] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] <... mmap resumed>) = 0x20000000 [pid 312] <... futex resumed>) = 0 [pid 327] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 327] <... futex resumed>) = 0 [pid 312] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) ./strace-static-x86_64: Process 324 attached [pid 327] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 312] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = ? [pid 324] +++ killed by SIGBUS +++ [pid 327] +++ killed by SIGBUS +++ [pid 312] +++ killed by SIGBUS +++ [pid 319] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 317] mount("/dev/loop1", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 308] <... futex resumed>) = 0 [pid 306] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=312, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 299] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] newfstatat(AT_FDCWD, "./0/bus", [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] unlink("./0/bus" [pid 300] <... openat resumed>) = 3 [pid 299] <... unlink resumed>) = 0 [pid 300] newfstatat(3, "", [pid 299] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] getdents64(3, [pid 299] newfstatat(AT_FDCWD, "./0/binderfs", [pid 300] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] unlink("./0/binderfs") = 0 [pid 299] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./0") = 0 [pid 299] mkdir("./1", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 329 [ 23.249421][ T30] audit: type=1400 audit(1694881038.106:72): avc: denied { map } for pid=302 comm="syz-executor172" path="/root/syzkaller.bzF58U/0/bus" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 23.277152][ T30] audit: type=1400 audit(1694881038.106:73): avc: denied { unmount } for pid=301 comm="syz-executor172" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 23.289812][ T311] EXT4-fs (loop5): mounted filesystem without journal. Opts: nodiscard,barrier,nouid32,grpquota,,errors=continue. Quota mode: writeback. ./strace-static-x86_64: Process 329 attached [pid 329] set_robust_list(0x555556cc76a0, 24) = 0 [pid 329] chdir("./1") = 0 [pid 329] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 329] setpgid(0, 0) = 0 [pid 329] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 329] write(3, "1000", 4) = 4 [pid 329] close(3) = 0 [pid 329] symlink("/dev/binderfs", "./binderfs") = 0 [pid 329] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 329] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 329] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 329] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 329] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 329] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 329] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[330]}, 88) = 330 [pid 329] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 329] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 329] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 329] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 329] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 329] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 329] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[331]}, 88) = 331 [pid 329] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 329] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 329] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] <... socket resumed>) = 4 [pid 313] <... futex resumed>) = 0 [pid 308] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 306] <... futex resumed>) = 1 [pid 300] <... umount2 resumed>) = 0 [pid 296] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 319] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 306] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 319] <... futex resumed>) = 1 [pid 313] <... socket resumed>) = 6 [pid 308] <... futex resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... openat resumed>) = 3 [pid 313] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] newfstatat(AT_FDCWD, "./0/bus", [pid 313] <... futex resumed>) = 1 [pid 306] <... futex resumed>) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 313] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 306] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] unlink("./0/bus" [pid 313] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 306] <... futex resumed>) = 0 [pid 300] <... unlink resumed>) = 0 [pid 313] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 3, 0 [ 23.297773][ T30] audit: type=1400 audit(1694881038.236:74): avc: denied { mounton } for pid=306 comm="syz-executor172" path="/root/syzkaller.bzF58U/1/file0" dev="sda1" ino=1947 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 23.337037][ T30] audit: type=1400 audit(1694881038.416:75): avc: denied { mount } for pid=306 comm="syz-executor172" name="/" dev="loop5" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 23.359422][ T311] ext4 filesystem being mounted at /root/syzkaller.bzF58U/1/file0 supports timestamps until 2038 (0x7fffffff) [pid 306] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 331 attached ./strace-static-x86_64: Process 330 attached [pid 319] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 313] <... mmap resumed>) = 0x20000000 [pid 311] <... mount resumed>) = 0 [pid 308] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] newfstatat(3, "", [pid 319] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 311] openat(AT_FDCWD, 0x20000000, O_RDONLY|O_DIRECTORY [pid 308] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 319] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 311] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 308] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(3, [pid 311] ioctl(5, LOOP_CLR_FD [pid 296] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 311] <... ioctl resumed>) = 0 [pid 311] close(5 [pid 296] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 311] <... close resumed>) = 0 [pid 311] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 311] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 331] set_robust_list(0x7f62204449a0, 24 [pid 330] set_robust_list(0x7f62204659a0, 24 [pid 329] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 322] +++ exited with 0 +++ [pid 319] <... mmap resumed>) = 0x20000000 [pid 315] +++ exited with 0 +++ [pid 313] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 329] futex(0x7f62205316ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] newfstatat(AT_FDCWD, "./0/binderfs", [pid 329] <... futex resumed>) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 329] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 317] <... mount resumed>) = 0 [pid 300] unlink("./0/binderfs" [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=315, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 296] <... umount2 resumed>) = 0 [pid 329] <... mmap resumed>) = 0x7f6220403000 [pid 300] <... unlink resumed>) = 0 [pid 298] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 329] mprotect(0x7f6220404000, 131072, PROT_READ|PROT_WRITE [pid 300] getdents64(3, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 329] <... mprotect resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 298] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 329] rt_sigprocmask(SIG_BLOCK, ~[], [pid 300] close(3 [pid 298] <... openat resumed>) = 3 [pid 329] <... rt_sigprocmask resumed>[], 8) = 0 [pid 300] <... close resumed>) = 0 [pid 298] newfstatat(3, "", [pid 296] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 329] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220423990, parent_tid=0x7f6220423990, exit_signal=0, stack=0x7f6220403000, stack_size=0x20300, tls=0x7f62204236c0} [pid 300] rmdir("./0" [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 334 attached [pid 331] <... set_robust_list resumed>) = 0 [pid 330] <... set_robust_list resumed>) = 0 [pid 319] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 317] openat(AT_FDCWD, 0x20000000, O_RDONLY|O_DIRECTORY [pid 313] <... futex resumed>) = 1 [pid 300] <... rmdir resumed>) = 0 [pid 298] getdents64(3, [pid 306] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 329] <... clone3 resumed> => {parent_tid=[334]}, 88) = 334 [pid 300] mkdir("./1", 0777 [pid 298] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 331] rt_sigprocmask(SIG_SETMASK, [], [pid 330] rt_sigprocmask(SIG_SETMASK, [], [pid 329] rt_sigprocmask(SIG_SETMASK, [], [pid 319] <... futex resumed>) = 1 [pid 308] <... futex resumed>) = 0 [pid 306] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... mkdir resumed>) = 0 [pid 298] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] newfstatat(AT_FDCWD, "./0/bus", [pid 334] set_robust_list(0x7f62204239a0, 24 [pid 331] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 317] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 313] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 329] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 334] <... set_robust_list resumed>) = 0 [pid 331] creat("./bus", 000 [pid 330] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 329] futex(0x7f62205316e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 319] memfd_create("syzkaller", 0 [pid 317] ioctl(5, LOOP_CLR_FD [pid 311] <... futex resumed>) = 0 [pid 308] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 306] <... futex resumed>) = 1 [pid 300] <... openat resumed>) = 3 [pid 298] <... umount2 resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 331] <... creat resumed>) = 3 [pid 330] memfd_create("syzkaller", 0 [pid 329] <... futex resumed>) = 0 [pid 311] memfd_create("syzkaller", 0 [pid 308] <... futex resumed>) = 0 [pid 319] <... memfd_create resumed>) = 7 [pid 300] ioctl(3, LOOP_CLR_FD [pid 298] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 317] <... ioctl resumed>) = 0 [pid 296] unlink("./0/bus" [pid 334] rt_sigprocmask(SIG_SETMASK, [], [pid 331] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] <... memfd_create resumed>) = 4 [pid 329] futex(0x7f62205316ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 311] <... memfd_create resumed>) = 5 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 334] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 331] <... futex resumed>) = 0 [pid 330] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 317] close(5 [pid 311] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 296] <... unlink resumed>) = 0 [pid 334] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 331] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 330] <... mmap resumed>) = 0x7f6218003000 [pid 319] <... mmap resumed>) = 0x7f620fc64000 [pid 317] <... close resumed>) = 0 [pid 311] <... mmap resumed>) = 0x7f620fc64000 [pid 300] close(3 [pid 298] newfstatat(AT_FDCWD, "./0/bus", [pid 296] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 330] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 264966 [pid 311] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 300] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 330] <... write resumed>) = 264966 [pid 319] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 317] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] <... write resumed>) = 65536 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] unlink("./0/bus" [pid 296] newfstatat(AT_FDCWD, "./0/binderfs", [pid 334] <... mount resumed>) = 0 [pid 330] munmap(0x7f6218003000, 264966 [pid 311] munmap(0x7f620fc64000, 65536 [pid 298] <... unlink resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 335 attached [pid 334] futex(0x7f62205316ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] <... munmap resumed>) = 0 [pid 311] <... munmap resumed>) = 0 [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 335 [pid 298] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./0/binderfs" [pid 335] set_robust_list(0x555556cc76a0, 24 [pid 334] <... futex resumed>) = 1 [pid 330] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 329] <... futex resumed>) = 0 [pid 319] <... write resumed>) = 65536 [pid 317] <... futex resumed>) = 0 [pid 311] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... unlink resumed>) = 0 [pid 334] futex(0x7f62205316e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 330] <... openat resumed>) = 5 [pid 329] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 319] munmap(0x7f620fc64000, 65536 [pid 317] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 311] <... openat resumed>) = 7 [pid 298] newfstatat(AT_FDCWD, "./0/binderfs", [pid 296] getdents64(3, [pid 331] <... futex resumed>) = 0 [pid 330] ioctl(5, LOOP_SET_FD, 4 [pid 329] <... futex resumed>) = 1 [pid 319] <... munmap resumed>) = 0 [pid 311] ioctl(7, LOOP_SET_FD, 5 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 335] <... set_robust_list resumed>) = 0 [pid 331] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 329] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] unlink("./0/binderfs" [pid 335] chdir("./1" [pid 298] <... unlink resumed>) = 0 [pid 335] <... chdir resumed>) = 0 [pid 298] getdents64(3, [pid 335] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 335] <... prctl resumed>) = 0 [pid 298] close(3 [pid 335] setpgid(0, 0 [pid 298] <... close resumed>) = 0 [pid 335] <... setpgid resumed>) = 0 [pid 298] rmdir("./0" [pid 335] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] <... rmdir resumed>) = 0 [pid 335] <... openat resumed>) = 3 [pid 298] mkdir("./1", 0777 [pid 335] write(3, "1000", 4 [pid 298] <... mkdir resumed>) = 0 [pid 335] <... write resumed>) = 4 [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 335] close(3 [pid 298] <... openat resumed>) = 3 [pid 335] <... close resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 335] symlink("/dev/binderfs", "./binderfs" [pid 311] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 331] <... open resumed>) = 6 [pid 330] <... ioctl resumed>) = 0 [pid 319] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 311] ioctl(7, LOOP_CLR_FD [pid 298] close(3 [pid 296] close(3 [pid 331] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] close(4 [pid 319] <... openat resumed>) = 5 [pid 311] <... ioctl resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 331] <... futex resumed>) = 1 [pid 330] <... close resumed>) = 0 [pid 329] <... futex resumed>) = 0 [pid 319] ioctl(5, LOOP_SET_FD, 7 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] rmdir("./0" [pid 335] <... symlink resumed>) = 0 [pid 331] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 330] mkdir("./file0", 0777 [pid 329] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 319] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 296] <... rmdir resumed>) = 0 [pid 335] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 331] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 330] <... mkdir resumed>) = 0 [pid 329] <... futex resumed>) = 0 [pid 319] ioctl(5, LOOP_CLR_FD [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 336 [pid 296] mkdir("./1", 0777 [pid 335] <... futex resumed>) = 0 [pid 331] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 330] mount("/dev/loop3", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 329] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] <... ioctl resumed>) = 0 [pid 311] ioctl(7, LOOP_SET_FD, 5 [pid 296] <... mkdir resumed>) = 0 [pid 335] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 331] <... socket resumed>) = 4 [pid 311] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 335] <... rt_sigaction resumed>NULL, 8) = 0 [pid 331] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] close(7 [pid 296] <... openat resumed>) = 3 [pid 335] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 331] <... futex resumed>) = 1 [pid 329] <... futex resumed>) = 0 [pid 311] <... close resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 335] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 331] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 329] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] close(5 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 335] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 331] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 329] <... futex resumed>) = 0 [pid 311] <... close resumed>) = 0 [pid 296] close(3 [pid 335] <... mmap resumed>) = 0x7f6220445000 [pid 331] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 329] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 319] ioctl(5, LOOP_SET_FD, 7 [pid 311] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 ./strace-static-x86_64: Process 336 attached [pid 335] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 331] <... mmap resumed>) = 0x20000000 [pid 319] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 311] <... futex resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 331] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 319] close(5 [pid 311] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 306] exit_group(0 [pid 335] <... mprotect resumed>) = 0 [pid 331] <... futex resumed>) = 1 [pid 329] <... futex resumed>) = 0 [pid 319] <... close resumed>) = 0 [pid 313] <... futex resumed>) = ? [pid 311] <... futex resumed>) = ? [pid 306] <... exit_group resumed>) = ? [pid 296] <... clone resumed>, child_tidptr=0x555556cc7690) = 337 [pid 335] rt_sigprocmask(SIG_BLOCK, ~[], [pid 331] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 329] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 319] close(7 [pid 313] +++ exited with 0 +++ [pid 311] +++ exited with 0 +++ [pid 306] +++ exited with 0 +++ [pid 335] <... rt_sigprocmask resumed>[], 8) = 0 [pid 331] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 329] <... futex resumed>) = 0 [pid 319] <... close resumed>) = 0 [pid 335] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 331] memfd_create("syzkaller", 0 [pid 319] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=306, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 336] set_robust_list(0x555556cc76a0, 24 [pid 331] <... memfd_create resumed>) = 7 [pid 319] <... futex resumed>) = 0 [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 336] <... set_robust_list resumed>) = 0 [pid 335] <... clone3 resumed> => {parent_tid=[339]}, 88) = 339 [pid 331] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 319] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 336] chdir("./1" [pid 335] rt_sigprocmask(SIG_SETMASK, [], [pid 331] <... mmap resumed>) = 0x7f620fc44000 [pid 335] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 336] <... chdir resumed>) = 0 [pid 336] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 301] <... restart_syscall resumed>) = 0 [pid 336] <... prctl resumed>) = 0 [pid 336] setpgid(0, 0 [pid 335] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 331] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 336] <... setpgid resumed>) = 0 [pid 335] <... futex resumed>) = 0 [pid 331] <... write resumed>) = 65536 [pid 308] exit_group(0 [pid 301] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 337 attached [pid 336] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 335] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 331] munmap(0x7f620fc44000, 65536 [pid 319] <... futex resumed>) = ? [pid 317] <... futex resumed>) = ? [pid 308] <... exit_group resumed>) = ? [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 337] set_robust_list(0x555556cc76a0, 24 [pid 336] <... openat resumed>) = 3 [pid 335] <... futex resumed>) = 0 [pid 331] <... munmap resumed>) = 0 [pid 319] +++ exited with 0 +++ [pid 317] +++ exited with 0 +++ [pid 308] +++ exited with 0 +++ [pid 301] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 337] <... set_robust_list resumed>) = 0 [pid 336] write(3, "1000", 4 [pid 335] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 331] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 301] <... openat resumed>) = 3 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=308, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 336] <... write resumed>) = 4 [ 23.361330][ T317] EXT4-fs (loop1): mounted filesystem without journal. Opts: nodiscard,barrier,nouid32,grpquota,,errors=continue. Quota mode: writeback. [ 23.385676][ T317] ext4 filesystem being mounted at /root/syzkaller.9gSDIa/0/file0 supports timestamps until 2038 (0x7fffffff) [ 23.412514][ T330] loop3: detected capacity change from 0 to 517 [pid 301] newfstatat(3, "", [pid 336] close(3 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 336] <... close resumed>) = 0 [pid 301] getdents64(3, [pid 297] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 336] symlink("/dev/binderfs", "./binderfs" [pid 301] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 336] <... symlink resumed>) = 0 [pid 301] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 336] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... openat resumed>) = 3 [pid 336] <... futex resumed>) = 0 [pid 297] newfstatat(3, "", [pid 336] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 336] <... rt_sigaction resumed>NULL, 8) = 0 [pid 297] getdents64(3, [pid 336] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 297] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 336] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 336] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 336] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 336] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 336] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[342]}, 88) = 342 [pid 336] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 336] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 336] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 336] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 336] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 336] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 336] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[343]}, 88) = 343 [pid 336] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 336] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 336] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 339 attached [pid 339] set_robust_list(0x7f62204659a0, 24) = 0 [pid 339] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 339] memfd_create("syzkaller", 0) = 3 [pid 339] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218045000 [pid 339] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 301] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 301] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 301] newfstatat(AT_FDCWD, "./1/bus", [pid 297] newfstatat(AT_FDCWD, "./0/bus", [pid 301] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 331] <... openat resumed>) = 8 [pid 301] unlink("./1/bus" [pid 297] unlink("./0/bus" [pid 337] chdir("./1" [pid 335] <... mmap resumed>) = 0x7f6218024000 [pid 331] ioctl(8, LOOP_SET_FD, 7 [pid 301] <... unlink resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 337] <... chdir resumed>) = 0 [pid 335] mprotect(0x7f6218025000, 131072, PROT_READ|PROT_WRITE [pid 331] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 301] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 337] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 335] <... mprotect resumed>) = 0 [pid 331] ioctl(8, LOOP_CLR_FD [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 301] newfstatat(AT_FDCWD, "./1/binderfs", [pid 297] newfstatat(AT_FDCWD, "./0/binderfs", [pid 301] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] unlink("./1/binderfs" [pid 297] unlink("./0/binderfs" [pid 339] <... write resumed>) = 262144 [pid 301] <... unlink resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 301] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 339] munmap(0x7f6218045000, 262144) = 0 [pid 339] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 339] ioctl(4, LOOP_SET_FD, 3 [pid 335] rt_sigprocmask(SIG_BLOCK, ~[], [pid 331] <... ioctl resumed>) = 0 [pid 335] <... rt_sigprocmask resumed>[], 8) = 0 [pid 337] <... prctl resumed>) = 0 [pid 335] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6218044990, parent_tid=0x7f6218044990, exit_signal=0, stack=0x7f6218024000, stack_size=0x20300, tls=0x7f62180446c0} => {parent_tid=[345]}, 88) = 345 [pid 335] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 335] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 331] ioctl(8, LOOP_SET_FD, 7 [pid 339] <... ioctl resumed>) = 0 [pid 331] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 335] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 331] close(8) = 0 [pid 331] close(7 [pid 337] setpgid(0, 0) = 0 [pid 331] <... close resumed>) = 0 [pid 331] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 331] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 337] <... openat resumed>) = 3 [pid 337] write(3, "1000", 4) = 4 [pid 337] close(3) = 0 [pid 337] symlink("/dev/binderfs", "./binderfs" [pid 339] close(3 [pid 337] <... symlink resumed>) = 0 [pid 337] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 345 attached ./strace-static-x86_64: Process 343 attached ./strace-static-x86_64: Process 342 attached ) = 0 [pid 345] set_robust_list(0x7f62180449a0, 24 [pid 343] set_robust_list(0x7f62204449a0, 24 [pid 342] set_robust_list(0x7f62204659a0, 24 [pid 337] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 345] <... set_robust_list resumed>) = 0 [pid 343] <... set_robust_list resumed>) = 0 [pid 342] <... set_robust_list resumed>) = 0 [pid 337] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 339] <... close resumed>) = 0 [pid 339] mkdir("./file0", 0777) = 0 [pid 339] mount("/dev/loop4", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 337] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 345] rt_sigprocmask(SIG_SETMASK, [], [pid 343] rt_sigprocmask(SIG_SETMASK, [], [pid 342] rt_sigprocmask(SIG_SETMASK, [], [pid 337] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 345] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 343] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 342] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 345] creat("./bus", 000 [pid 337] <... mmap resumed>) = 0x7f6220445000 [pid 343] creat("./bus", 000 [pid 342] memfd_create("syzkaller", 0 [pid 345] <... creat resumed>) = 3 [pid 343] <... creat resumed>) = 3 [pid 342] <... memfd_create resumed>) = 4 [pid 337] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 345] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 335] <... futex resumed>) = 0 [pid 345] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 335] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... mount resumed>) = 0 [pid 335] <... futex resumed>) = 0 [pid 345] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 0 [pid 335] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 345] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [ 23.433249][ T338] EXT4-fs warning (device loop3): kmmpd:170: kmmpd being stopped since MMP feature has been disabled. [ 23.446237][ T330] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 23.451486][ T339] loop4: detected capacity change from 0 to 512 [ 23.466961][ T330] EXT4-fs error (device loop3): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # [pid 335] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... open resumed>) = 5 [pid 335] <... futex resumed>) = 0 [pid 345] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 0 [pid 335] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 345] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 335] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... socket resumed>) = 6 [pid 335] <... futex resumed>) = 0 [pid 345] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 0 [pid 335] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 345] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 335] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... mmap resumed>) = 0x20000000 [pid 335] <... futex resumed>) = 0 [pid 345] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... futex resumed>) = 0 [pid 335] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 345] memfd_create("syzkaller", 0 [pid 335] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... memfd_create resumed>) = 7 [pid 335] <... futex resumed>) = 0 [pid 345] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f620fc24000 [pid 345] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 343] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 337] <... mprotect resumed>) = 0 [pid 343] <... futex resumed>) = 1 [pid 342] <... mmap resumed>) = 0x7f6218024000 [pid 336] <... futex resumed>) = 0 [pid 337] rt_sigprocmask(SIG_BLOCK, ~[], [pid 336] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... write resumed>) = 65536 [pid 343] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 342] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 337] <... rt_sigprocmask resumed>[], 8) = 0 [pid 336] <... futex resumed>) = 0 [pid 345] munmap(0x7f620fc24000, 65536 [pid 343] <... mount resumed>) = 0 [pid 342] <... write resumed>) = 262144 [pid 337] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 336] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... munmap resumed>) = 0 [pid 343] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] munmap(0x7f6218024000, 262144 [pid 336] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 345] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 343] <... futex resumed>) = 0 [pid 342] <... munmap resumed>) = 0 [pid 337] <... clone3 resumed> => {parent_tid=[346]}, 88) = 346 [pid 336] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... openat resumed>) = 8 [pid 343] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 342] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 337] rt_sigprocmask(SIG_SETMASK, [], [pid 336] <... futex resumed>) = 0 [pid 345] ioctl(8, LOOP_SET_FD, 7 [pid 343] <... open resumed>) = 5 [pid 342] <... openat resumed>) = 6 [pid 337] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 336] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 343] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] ioctl(6, LOOP_SET_FD, 4 [pid 337] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 336] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 345] ioctl(8, LOOP_CLR_FD [pid 343] <... futex resumed>) = 0 [pid 337] <... futex resumed>) = 0 [pid 336] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... ioctl resumed>) = 0 [pid 343] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 337] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 336] <... futex resumed>) = 0 [pid 301] <... umount2 resumed>) = 0 [pid 343] <... socket resumed>) = 7 [pid 337] <... futex resumed>) = 0 [pid 336] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 343] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 336] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] <... umount2 resumed>) = 0 [pid 343] <... futex resumed>) = 0 [pid 337] <... mmap resumed>) = 0x7f6220424000 [pid 336] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 337] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 336] <... futex resumed>) = 0 [pid 345] ioctl(8, LOOP_SET_FD, 7 [pid 343] <... mmap resumed>) = 0x20000000 [pid 337] <... mprotect resumed>) = 0 [pid 336] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 345] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 343] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] rt_sigprocmask(SIG_BLOCK, ~[], [pid 336] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 345] close(8 [pid 343] <... futex resumed>) = 0 [pid 337] <... rt_sigprocmask resumed>[], 8) = 0 [pid 336] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 345] <... close resumed>) = 0 [pid 337] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 336] <... futex resumed>) = 0 [pid 301] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 345] close(7 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 345] <... close resumed>) = 0 [pid 337] <... clone3 resumed> => {parent_tid=[347]}, 88) = 347 [pid 330] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 301] newfstatat(AT_FDCWD, "./1/file0", [pid 297] newfstatat(AT_FDCWD, "./0/file0", [pid 345] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] rt_sigprocmask(SIG_SETMASK, [], [pid 345] <... futex resumed>) = 0 [pid 337] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 345] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 337] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 337] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 347 attached [pid 347] set_robust_list(0x7f62204449a0, 24) = 0 [pid 347] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 347] creat("./bus", 000 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 330] ioctl(5, LOOP_CLR_FD [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 330] <... ioctl resumed>) = 0 [pid 330] close(5 [pid 301] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 339] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 330] <... close resumed>) = 0 [pid 301] <... openat resumed>) = 4 [pid 297] openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 339] ioctl(4, LOOP_CLR_FD [pid 330] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] newfstatat(4, "", [pid 297] <... openat resumed>) = 4 [pid 329] exit_group(0 [pid 330] <... futex resumed>) = ? [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] newfstatat(4, "", [pid 339] <... ioctl resumed>) = 0 [pid 334] <... futex resumed>) = ? [pid 331] <... futex resumed>) = ? [pid 329] <... exit_group resumed>) = ? [pid 301] getdents64(4, [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 339] close(4 [pid 334] +++ exited with 0 +++ [pid 331] +++ exited with 0 +++ [pid 301] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, [pid 301] getdents64(4, [pid 297] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 301] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 339] <... close resumed>) = 0 [pid 297] getdents64(4, [pid 339] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] close(4 [pid 297] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 301] <... close resumed>) = 0 [pid 297] close(4 [pid 339] <... futex resumed>) = 0 [pid 301] rmdir("./1/file0" [pid 297] <... close resumed>) = 0 [pid 347] <... creat resumed>) = 3 [pid 339] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] <... rmdir resumed>) = 0 [pid 297] rmdir("./0/file0" [pid 301] getdents64(3, ./strace-static-x86_64: Process 346 attached [pid 347] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] exit_group(0 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 347] <... futex resumed>) = 1 [pid 346] set_robust_list(0x7f62204659a0, 24 [pid 345] <... futex resumed>) = ? [pid 339] <... futex resumed>) = ? [pid 337] <... futex resumed>) = 0 [pid 335] <... exit_group resumed>) = ? [pid 301] close(3 [pid 297] getdents64(3, [pid 347] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 346] <... set_robust_list resumed>) = 0 [pid 345] +++ exited with 0 +++ [pid 343] memfd_create("syzkaller", 0 [pid 342] <... ioctl resumed>) = 0 [pid 339] +++ exited with 0 +++ [pid 337] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... close resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 343] <... memfd_create resumed>) = 8 [pid 342] close(4 [pid 301] rmdir("./1" [pid 297] close(3 [pid 347] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 346] rt_sigprocmask(SIG_SETMASK, [], [pid 343] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 342] <... close resumed>) = 0 [pid 337] <... futex resumed>) = 0 [pid 301] <... rmdir resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 347] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 343] <... mmap resumed>) = 0x7f620fc64000 [pid 342] mkdir(0x20000000, 0777 [pid 337] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] mkdir("./2", 0777 [pid 297] rmdir("./0" [pid 347] <... mount resumed>) = 0 [pid 346] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 342] <... mkdir resumed>) = 0 [pid 347] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 346] memfd_create("syzkaller", 0 [pid 337] <... futex resumed>) = 0 [pid 301] <... mkdir resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [ 23.482056][ T330] EXT4-fs (loop3): get orphan inode failed [ 23.489061][ T330] EXT4-fs (loop3): mount failed [ 23.493807][ T339] EXT4-fs warning (device loop4): read_mmp_block:115: Error -74 while reading MMP block 12 [ 23.494290][ T342] loop2: detected capacity change from 0 to 512 [ 23.514262][ T343] blk_update_request: I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 18 prio class 0 [pid 347] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 346] <... memfd_create resumed>) = 4 [pid 342] mount("/dev/loop2", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 337] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 343] write(8, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 297] mkdir("./1", 0777 [pid 347] <... open resumed>) = 5 [pid 346] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 337] <... futex resumed>) = 0 [pid 301] <... openat resumed>) = 3 [pid 347] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... mmap resumed>) = 0x7f6218024000 [pid 337] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 347] <... futex resumed>) = 0 [pid 346] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 337] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] ioctl(3, LOOP_CLR_FD [pid 297] <... mkdir resumed>) = 0 [pid 347] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 346] <... write resumed>) = 262144 [pid 337] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... socket resumed>) = 6 [pid 337] <... futex resumed>) = 0 [pid 347] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 347] <... futex resumed>) = 0 [pid 337] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 347] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 337] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... mmap resumed>) = 0x20000000 [pid 337] <... futex resumed>) = 0 [pid 347] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 337] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 347] <... futex resumed>) = 0 [pid 337] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 347] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 337] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = ? [pid 347] +++ killed by SIGBUS +++ [pid 346] +++ killed by SIGBUS +++ [pid 337] +++ killed by SIGBUS +++ [pid 343] <... write resumed>) = 65536 [pid 343] munmap(0x7f620fc64000, 65536 [pid 301] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 342] <... mount resumed>) = -1 ENODEV (No such device) [pid 301] close(3 [pid 342] ioctl(6, LOOP_CLR_FD [pid 297] <... openat resumed>) = 3 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=337, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 301] <... close resumed>) = 0 [pid 342] <... ioctl resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 342] close(6 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 343] <... munmap resumed>) = 0 [pid 343] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 297] close(3 [pid 301] <... clone resumed>, child_tidptr=0x555556cc7690) = 348 [pid 297] <... close resumed>) = 0 ./strace-static-x86_64: Process 348 attached [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... restart_syscall resumed>) = 0 [pid 343] <... openat resumed>) = 4 [pid 343] ioctl(4, LOOP_SET_FD, 8) = -1 EBUSY (Device or resource busy) [pid 343] ioctl(4, LOOP_CLR_FD [pid 297] <... clone resumed>, child_tidptr=0x555556cc7690) = 349 [pid 342] <... close resumed>) = 0 [pid 343] <... ioctl resumed>) = 0 [pid 296] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 342] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 342] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 342] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 348] set_robust_list(0x555556cc76a0, 24 [pid 296] getdents64(3, 0x555556cc8730 /* 4 entries */, 32768) = 104 ./strace-static-x86_64: Process 349 attached [pid 348] <... set_robust_list resumed>) = 0 [pid 296] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 296] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 349] set_robust_list(0x555556cc76a0, 24 [pid 348] chdir("./2" [pid 349] <... set_robust_list resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./1/bus", [pid 343] ioctl(4, LOOP_SET_FD, 8 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 343] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 296] unlink("./1/bus" [pid 343] close(4) = 0 [pid 343] close(8 [pid 296] <... unlink resumed>) = 0 [pid 349] chdir("./1" [pid 348] <... chdir resumed>) = 0 [pid 296] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 343] <... close resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./1/binderfs", [pid 343] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 343] <... futex resumed>) = 0 [pid 296] unlink("./1/binderfs" [pid 343] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... unlink resumed>) = 0 [pid 296] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./1" [pid 349] <... chdir resumed>) = 0 [pid 336] exit_group(0 [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./2", 0777 [pid 349] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 348] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 343] <... futex resumed>) = ? [pid 342] <... futex resumed>) = ? [pid 336] <... exit_group resumed>) = ? [pid 342] +++ exited with 0 +++ [pid 296] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 349] <... prctl resumed>) = 0 [pid 348] <... prctl resumed>) = 0 ./strace-static-x86_64: Process 350 attached [pid 349] setpgid(0, 0 [pid 350] set_robust_list(0x555556cc76a0, 24 [pid 349] <... setpgid resumed>) = 0 [pid 348] setpgid(0, 0 [pid 296] <... clone resumed>, child_tidptr=0x555556cc7690) = 350 [pid 350] <... set_robust_list resumed>) = 0 [pid 350] chdir("./2") = 0 [pid 350] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 350] setpgid(0, 0 [pid 349] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 350] <... setpgid resumed>) = 0 [pid 348] <... setpgid resumed>) = 0 [pid 350] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 349] <... openat resumed>) = 3 [pid 348] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 350] <... openat resumed>) = 3 [pid 350] write(3, "1000", 4) = 4 [pid 350] close(3) = 0 [pid 350] symlink("/dev/binderfs", "./binderfs") = 0 [pid 349] write(3, "1000", 4 [pid 350] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 348] <... openat resumed>) = 3 [pid 349] <... write resumed>) = 4 [pid 350] <... rt_sigaction resumed>NULL, 8) = 0 [pid 349] close(3 [pid 348] write(3, "1000", 4 [pid 350] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 349] <... close resumed>) = 0 [pid 350] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 348] <... write resumed>) = 4 [pid 350] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 349] symlink("/dev/binderfs", "./binderfs" [pid 348] close(3 [pid 350] <... mmap resumed>) = 0x7f6220445000 [pid 350] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 349] <... symlink resumed>) = 0 [pid 348] <... close resumed>) = 0 [pid 350] <... mprotect resumed>) = 0 [pid 349] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] symlink("/dev/binderfs", "./binderfs" [pid 350] rt_sigprocmask(SIG_BLOCK, ~[], [pid 349] <... futex resumed>) = 0 [pid 348] <... symlink resumed>) = 0 [pid 350] <... rt_sigprocmask resumed>[], 8) = 0 [pid 349] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 348] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 349] <... rt_sigaction resumed>NULL, 8) = 0 [pid 348] <... futex resumed>) = 0 [pid 349] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 348] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 349] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 348] <... rt_sigaction resumed>NULL, 8) = 0 [pid 349] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 348] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 349] <... mmap resumed>) = 0x7f6220445000 [pid 348] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 349] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 348] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 349] <... mprotect resumed>) = 0 [pid 348] <... mmap resumed>) = 0x7f6220445000 [pid 349] rt_sigprocmask(SIG_BLOCK, ~[], [pid 348] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 349] <... rt_sigprocmask resumed>[], 8) = 0 [pid 348] <... mprotect resumed>) = 0 [pid 349] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 348] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 330] +++ exited with 0 +++ [pid 329] +++ exited with 0 +++ [pid 349] <... clone3 resumed> => {parent_tid=[351]}, 88) = 351 [pid 348] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 349] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 348] <... clone3 resumed> => {parent_tid=[352]}, 88) = 352 [pid 349] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] rt_sigprocmask(SIG_SETMASK, [], [pid 349] <... futex resumed>) = 0 [pid 348] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 349] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 349] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 348] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] <... mmap resumed>) = 0x7f6220424000 [pid 348] <... futex resumed>) = 0 [pid 349] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 348] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 349] <... mprotect resumed>) = 0 [pid 348] <... mmap resumed>) = 0x7f6220424000 [pid 349] rt_sigprocmask(SIG_BLOCK, ~[], [pid 348] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 349] <... rt_sigprocmask resumed>[], 8) = 0 [pid 348] <... mprotect resumed>) = 0 [pid 349] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 348] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 349] <... clone3 resumed> => {parent_tid=[353]}, 88) = 353 [pid 348] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 349] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 348] <... clone3 resumed> => {parent_tid=[354]}, 88) = 354 [pid 349] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] rt_sigprocmask(SIG_SETMASK, [], [pid 349] <... futex resumed>) = 0 [pid 348] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 349] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 348] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 353 attached [pid 353] set_robust_list(0x7f62204449a0, 24) = 0 [pid 353] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 353] creat("./bus", 000./strace-static-x86_64: Process 351 attached [pid 351] set_robust_list(0x7f62204659a0, 24) = 0 [pid 351] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 351] memfd_create("syzkaller", 0 [pid 353] <... creat resumed>) = 3 [pid 351] <... memfd_create resumed>) = 4 [pid 351] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218024000 [pid 353] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=329, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 349] <... futex resumed>) = 0 [pid 299] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 349] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 349] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 353] <... futex resumed>) = 1 [pid 299] getdents64(3, [pid 353] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 299] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 353] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 349] <... futex resumed>) = 0 [pid 349] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 349] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 353] <... futex resumed>) = 1 [pid 353] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 353] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] <... futex resumed>) = 0 [pid 349] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 353] <... futex resumed>) = 1 [pid 353] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 299] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./1/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./1/bus" [pid 353] <... socket resumed>) = 6 [pid 353] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] <... futex resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 349] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 299] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 349] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 353] <... futex resumed>) = 1 [pid 299] newfstatat(AT_FDCWD, "./1/binderfs", [pid 353] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 353] <... mmap resumed>) = 0x20000000 [pid 299] unlink("./1/binderfs" [pid 353] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 349] <... futex resumed>) = 0 [pid 349] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 299] <... unlink resumed>) = 0 [pid 299] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./1/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 353] <... futex resumed>) = 1 [pid 351] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20001334} --- [pid 299] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 350] <... clone3 resumed> => {parent_tid=[355]}, 88) = 355 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 353] +++ killed by SIGBUS +++ [pid 350] rt_sigprocmask(SIG_SETMASK, [], [pid 299] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 350] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... openat resumed>) = 4 [pid 350] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 335] +++ exited with 0 +++ [pid 299] newfstatat(4, "", [pid 350] <... futex resumed>) = 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=335, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 350] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] getdents64(4, [pid 351] +++ killed by SIGBUS +++ [pid 350] <... futex resumed>) = 0 [pid 349] +++ killed by SIGBUS +++ [pid 299] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 350] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] getdents64(4, [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=349, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 299] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 300] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 350] <... mmap resumed>) = 0x7f6220424000 [pid 299] close(4 [pid 300] <... openat resumed>) = 3 [pid 350] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 300] newfstatat(3, "", [pid 299] <... close resumed>) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] rmdir("./1/file0" [pid 350] <... mprotect resumed>) = 0 [pid 300] getdents64(3, ./strace-static-x86_64: Process 355 attached [pid 355] set_robust_list(0x7f62204659a0, 24) = 0 [pid 355] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 355] memfd_create("syzkaller", 0 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 299] <... rmdir resumed>) = 0 [pid 350] rt_sigprocmask(SIG_BLOCK, ~[], [pid 300] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 350] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] getdents64(3, [pid 350] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 300] <... umount2 resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 300] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] close(3 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] newfstatat(AT_FDCWD, "./1/bus", [pid 299] <... close resumed>) = 0 [pid 355] <... memfd_create resumed>) = 3 [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] unlink("./1/bus" [pid 299] rmdir("./1" [pid 355] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218024000 [pid 350] <... clone3 resumed> => {parent_tid=[356]}, 88) = 356 [pid 300] <... unlink resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 297] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 350] rt_sigprocmask(SIG_SETMASK, [], [pid 300] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] mkdir("./2", 0777 [pid 350] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 355] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 350] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] newfstatat(AT_FDCWD, "./1/binderfs", [pid 299] <... mkdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 350] <... futex resumed>) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 350] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] unlink("./1/binderfs" [pid 297] <... openat resumed>) = 3 [pid 299] <... openat resumed>) = 3 [pid 300] <... unlink resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] newfstatat(3, "", [pid 300] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] close(3 [pid 355] <... write resumed>) = 262144 [pid 300] newfstatat(AT_FDCWD, "./1/file0", [pid 299] <... close resumed>) = 0 [pid 297] getdents64(3, [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 355] munmap(0x7f6218024000, 262144 [pid 297] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 300] umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 355] <... munmap resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... clone resumed>, child_tidptr=0x555556cc7690) = 357 [pid 355] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 300] <... openat resumed>) = 4 [pid 297] <... umount2 resumed>) = 0 [pid 300] newfstatat(4, "", [pid 297] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] getdents64(4, [pid 297] newfstatat(AT_FDCWD, "./1/bus", ./strace-static-x86_64: Process 356 attached [pid 355] <... openat resumed>) = 4 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] getdents64(4, [pid 297] unlink("./1/bus" [pid 356] set_robust_list(0x7f62204449a0, 24 [pid 355] ioctl(4, LOOP_SET_FD, 3 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 357 attached ./strace-static-x86_64: Process 354 attached ./strace-static-x86_64: Process 352 attached [pid 356] <... set_robust_list resumed>) = 0 [pid 355] <... ioctl resumed>) = 0 [pid 300] close(4 [pid 297] <... unlink resumed>) = 0 [pid 356] rt_sigprocmask(SIG_SETMASK, [], [pid 355] close(3 [pid 300] <... close resumed>) = 0 [pid 297] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 356] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 355] <... close resumed>) = 0 [pid 300] rmdir("./1/file0" [pid 356] creat("./bus", 000 [pid 355] mkdir("./file0", 0777 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 356] <... creat resumed>) = 3 [pid 300] <... rmdir resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./1/binderfs", [pid 356] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 355] <... mkdir resumed>) = 0 [pid 300] getdents64(3, [pid 356] <... futex resumed>) = 1 [pid 350] <... futex resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 356] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 355] mount("/dev/loop0", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 354] set_robust_list(0x7f62204449a0, 24 [pid 350] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 297] unlink("./1/binderfs" [pid 356] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 354] <... set_robust_list resumed>) = 0 [pid 352] set_robust_list(0x7f62204659a0, 24 [pid 350] <... futex resumed>) = 0 [pid 300] close(3 [pid 356] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 350] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... unlink resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 356] <... mount resumed>) = 0 [pid 354] rt_sigprocmask(SIG_SETMASK, [], [pid 300] rmdir("./1" [pid 297] getdents64(3, [pid 356] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 354] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 352] <... set_robust_list resumed>) = 0 [pid 356] <... futex resumed>) = 1 [pid 350] <... futex resumed>) = 0 [pid 356] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 350] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 350] <... futex resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 356] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 350] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] mkdir("./2", 0777 [pid 297] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 357] set_robust_list(0x555556cc76a0, 24 [pid 356] <... open resumed>) = 5 [pid 354] creat("./bus", 000 [pid 352] rt_sigprocmask(SIG_SETMASK, [], [pid 343] +++ exited with 0 +++ [pid 336] +++ exited with 0 +++ [pid 356] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=336, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 297] close(3 [pid 356] <... futex resumed>) = 1 [pid 350] <... futex resumed>) = 0 [pid 356] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 350] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... mkdir resumed>) = 0 [pid 356] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 350] <... futex resumed>) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 298] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... close resumed>) = 0 [pid 356] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 354] <... creat resumed>) = 3 [pid 352] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 350] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... openat resumed>) = 3 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] rmdir("./1" [pid 356] <... socket resumed>) = 6 [pid 354] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] ioctl(3, LOOP_CLR_FD [pid 298] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 356] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 354] <... futex resumed>) = 1 [pid 352] memfd_create("syzkaller", 0 [pid 348] <... futex resumed>) = 0 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... openat resumed>) = 3 [pid 297] <... rmdir resumed>) = 0 [pid 356] <... futex resumed>) = 1 [pid 354] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 352] <... memfd_create resumed>) = 4 [pid 350] <... futex resumed>) = 0 [pid 348] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] close(3 [pid 298] newfstatat(3, "", [pid 297] mkdir("./2", 0777 [pid 357] <... set_robust_list resumed>) = 0 [pid 356] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 354] <... mount resumed>) = 0 [pid 352] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 350] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] <... futex resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 356] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 350] <... futex resumed>) = 0 [pid 348] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(3, [pid 356] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 354] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 352] <... mmap resumed>) = 0x7f6218024000 [pid 350] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 357] chdir("./2" [pid 298] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 128 [pid 297] <... mkdir resumed>) = 0 [pid 356] <... mmap resumed>) = 0x20000000 [pid 354] <... futex resumed>) = 0 [pid 348] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 356] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] <... futex resumed>) = 0 [pid 356] <... futex resumed>) = 1 [pid 354] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 350] <... futex resumed>) = 0 [pid 348] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... umount2 resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 356] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 350] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 360 [pid 298] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 356] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 354] <... open resumed>) = 5 [pid 350] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... openat resumed>) = 3 [pid 356] memfd_create("syzkaller", 0 [pid 354] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(AT_FDCWD, "./1/bus", [pid 297] ioctl(3, LOOP_CLR_FD [pid 356] <... memfd_create resumed>) = 7 [pid 354] <... futex resumed>) = 1 [pid 348] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 357] <... chdir resumed>) = 0 [pid 356] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 354] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 348] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] unlink("./1/bus" [pid 297] close(3 [pid 356] <... mmap resumed>) = 0x7f620fc64000 [pid 348] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 357] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 356] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 354] <... socket resumed>) = 6 [pid 352] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 265740 [pid 348] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... close resumed>) = 0 [pid 357] <... prctl resumed>) = 0 [pid 356] <... write resumed>) = 65536 [pid 354] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 357] setpgid(0, 0 [pid 356] munmap(0x7f620fc64000, 65536 [pid 354] <... futex resumed>) = 1 [pid 348] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./1/binderfs", ./strace-static-x86_64: Process 360 attached [pid 356] <... munmap resumed>) = 0 [pid 348] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 360] set_robust_list(0x555556cc76a0, 24 [pid 357] <... setpgid resumed>) = 0 [pid 356] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 354] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 348] <... futex resumed>) = 0 [pid 298] unlink("./1/binderfs" [pid 360] <... set_robust_list resumed>) = 0 [pid 356] <... openat resumed>) = 8 [pid 354] <... mmap resumed>) = 0x20000000 [pid 348] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... unlink resumed>) = 0 [pid 357] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... clone resumed>, child_tidptr=0x555556cc7690) = 361 [pid 360] chdir("./2" [pid 356] ioctl(8, LOOP_SET_FD, 7 [pid 354] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./1/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 360] <... chdir resumed>) = 0 [pid 357] <... openat resumed>) = 3 [pid 356] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 354] <... futex resumed>) = 1 [pid 348] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 360] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 356] ioctl(8, LOOP_CLR_FD [pid 348] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(AT_FDCWD, "./1/ext4", [pid 354] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 357] write(3, "1000", 4 [pid 360] <... prctl resumed>) = 0 [pid 356] <... ioctl resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 360] setpgid(0, 0 [pid 298] umount2("./1/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 360] <... setpgid resumed>) = 0 [pid 357] <... write resumed>) = 4 [pid 352] <... write resumed>) = ? [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 360] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 357] close(3 [pid 298] openat(AT_FDCWD, "./1/ext4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 360] <... openat resumed>) = 3 [pid 357] <... close resumed>) = 0 [pid 352] +++ killed by SIGBUS +++ [pid 298] <... openat resumed>) = 4 ./strace-static-x86_64: Process 361 attached [pid 360] write(3, "1000", 4 [pid 298] newfstatat(4, "", [pid 361] set_robust_list(0x555556cc76a0, 24 [pid 360] <... write resumed>) = 4 [pid 356] ioctl(8, LOOP_SET_FD, 7 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 361] <... set_robust_list resumed>) = 0 [pid 360] close(3 [pid 356] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 298] getdents64(4, [pid 361] chdir("./2" [pid 360] <... close resumed>) = 0 [pid 356] close(8 [pid 298] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 361] <... chdir resumed>) = 0 [pid 360] symlink("/dev/binderfs", "./binderfs" [pid 356] <... close resumed>) = 0 [pid 298] getdents64(4, [pid 361] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 360] <... symlink resumed>) = 0 [pid 356] close(7 [pid 354] +++ killed by SIGBUS +++ [pid 357] symlink("/dev/binderfs", "./binderfs" [pid 348] +++ killed by SIGBUS +++ [pid 298] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 361] <... prctl resumed>) = 0 [pid 360] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... close resumed>) = 0 [pid 298] close(4 [pid 357] <... symlink resumed>) = 0 [pid 361] setpgid(0, 0 [pid 360] <... futex resumed>) = 0 [pid 356] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=348, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 298] <... close resumed>) = 0 [pid 361] <... setpgid resumed>) = 0 [pid 360] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 357] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... futex resumed>) = 0 [pid 301] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] rmdir("./1/ext4" [pid 361] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 360] <... rt_sigaction resumed>NULL, 8) = 0 [pid 357] <... futex resumed>) = 0 [pid 356] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... rmdir resumed>) = 0 [pid 361] <... openat resumed>) = 3 [pid 360] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 357] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 301] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [ 23.540118][ T342] request_module fs- succeeded, but still no fs? [ 23.576795][ T355] loop0: detected capacity change from 0 to 512 [pid 298] getdents64(3, [pid 361] write(3, "1000", 4 [pid 360] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 357] <... rt_sigaction resumed>NULL, 8) = 0 [pid 301] <... openat resumed>) = 3 [pid 298] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 361] <... write resumed>) = 4 [pid 360] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] close(3 [pid 361] close(3 [pid 360] <... mmap resumed>) = 0x7f6220445000 [pid 357] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 301] newfstatat(3, "", [pid 298] <... close resumed>) = 0 [pid 361] <... close resumed>) = 0 [pid 360] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 298] rmdir("./1" [pid 361] symlink("/dev/binderfs", "./binderfs" [pid 360] <... mprotect resumed>) = 0 [pid 357] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 361] <... symlink resumed>) = 0 [pid 360] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] mkdir("./2", 0777 [pid 361] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 360] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 361] <... futex resumed>) = 0 [pid 360] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 361] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 298] <... openat resumed>) = 3 [pid 361] <... rt_sigaction resumed>NULL, 8) = 0 [pid 360] <... clone3 resumed> => {parent_tid=[362]}, 88) = 362 [pid 298] ioctl(3, LOOP_CLR_FD [pid 361] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 360] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 361] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 360] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] close(3 [pid 361] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 360] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 361] <... mmap resumed>) = 0x7f6220445000 [pid 360] <... futex resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 361] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 360] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 361] <... mprotect resumed>) = 0 [pid 360] <... futex resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 363 [pid 361] rt_sigprocmask(SIG_BLOCK, ~[], [pid 360] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 361] <... rt_sigprocmask resumed>[], 8) = 0 [pid 360] <... mmap resumed>) = 0x7f6220424000 [pid 361] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 360] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 361] <... clone3 resumed> => {parent_tid=[364]}, 88) = 364 [pid 360] rt_sigprocmask(SIG_BLOCK, ~[], [pid 361] rt_sigprocmask(SIG_SETMASK, [], [pid 360] <... rt_sigprocmask resumed>[], 8) = 0 [pid 361] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 360] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 361] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 360] <... clone3 resumed> => {parent_tid=[365]}, 88) = 365 [pid 361] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 360] rt_sigprocmask(SIG_SETMASK, [], [pid 361] <... futex resumed>) = 0 [pid 360] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 361] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 360] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 361] <... mmap resumed>) = 0x7f6220424000 [pid 360] <... futex resumed>) = 0 [pid 361] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 360] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 361] <... mprotect resumed>) = 0 [pid 361] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 361] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[366]}, 88) = 366 [pid 361] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 361] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 365 attached [pid 365] set_robust_list(0x7f62204449a0, 24) = 0 [pid 365] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 365] creat("./bus", 000) = 3 ./strace-static-x86_64: Process 364 attached [pid 364] set_robust_list(0x7f62204659a0, 24) = 0 [pid 364] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 364] memfd_create("syzkaller", 0./strace-static-x86_64: Process 366 attached [pid 366] set_robust_list(0x7f62204449a0, 24) = 0 [pid 366] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 366] creat("./bus", 000) = 3 [pid 364] <... memfd_create resumed>) = 4 [pid 365] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 360] <... futex resumed>) = 0 [pid 360] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 360] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 364] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 365] <... futex resumed>) = 1 [pid 365] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 364] <... mmap resumed>) = 0x7f6218024000 [pid 365] <... mount resumed>) = 0 [pid 366] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 361] <... futex resumed>) = 0 [pid 361] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 361] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 366] <... futex resumed>) = 1 [pid 365] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL./strace-static-x86_64: Process 363 attached [pid 360] <... futex resumed>) = 0 [pid 360] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 360] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 366] <... mount resumed>) = 0 [pid 365] <... futex resumed>) = 1 [pid 365] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 363] set_robust_list(0x555556cc76a0, 24 [pid 365] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... set_robust_list resumed>) = 0 [pid 366] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 365] <... futex resumed>) = 1 [pid 363] chdir("./2" [pid 360] <... futex resumed>) = 0 [pid 366] <... futex resumed>) = 1 [pid 365] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 363] <... chdir resumed>) = 0 [pid 361] <... futex resumed>) = 0 [pid 360] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 365] <... socket resumed>) = 5 [pid 363] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 361] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 360] <... futex resumed>) = 0 [pid 366] <... open resumed>) = 5 [pid 365] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... prctl resumed>) = 0 [pid 361] <... futex resumed>) = 0 [pid 360] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 362 attached [pid 366] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 365] <... futex resumed>) = 0 [pid 363] setpgid(0, 0 [pid 361] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 360] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 366] <... futex resumed>) = 0 [pid 365] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] <... setpgid resumed>) = 0 [pid 362] set_robust_list(0x7f62204659a0, 24 [pid 361] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 360] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 366] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 365] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 363] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 362] <... set_robust_list resumed>) = 0 [pid 361] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 360] <... futex resumed>) = 0 [pid 366] <... socket resumed>) = 6 [pid 365] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0 [pid 363] <... openat resumed>) = 3 [pid 362] rt_sigprocmask(SIG_SETMASK, [], [pid 361] <... futex resumed>) = 0 [pid 360] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 366] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 365] <... mmap resumed>) = 0x20000000 [pid 364] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 265739 [pid 363] write(3, "1000", 4 [pid 362] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 361] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 366] <... futex resumed>) = 0 [pid 365] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... write resumed>) = 4 [pid 362] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200005c4} --- [pid 361] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 366] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 365] <... futex resumed>) = ? [pid 364] <... write resumed>) = 265739 [pid 363] close(3 [pid 361] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 360] <... futex resumed>) = ? [pid 366] <... mmap resumed>) = 0x20000000 [pid 365] +++ killed by SIGBUS +++ [pid 363] <... close resumed>) = 0 [pid 361] <... futex resumed>) = 0 [pid 366] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] symlink("/dev/binderfs", "./binderfs" [pid 362] +++ killed by SIGBUS +++ [pid 361] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 360] +++ killed by SIGBUS +++ [pid 366] <... futex resumed>) = 0 [pid 363] <... symlink resumed>) = 0 [pid 361] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 366] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 363] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 361] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=360, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 301] getdents64(3, [pid 363] <... futex resumed>) = 0 [pid 361] <... futex resumed>) = ? [pid 357] <... mmap resumed>) = 0x7f6220445000 [pid 363] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 301] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 364] +++ killed by SIGBUS +++ [pid 363] <... rt_sigaction resumed>NULL, 8) = 0 [pid 357] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 301] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 366] +++ killed by SIGBUS +++ [pid 363] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 361] +++ killed by SIGBUS +++ [pid 357] <... mprotect resumed>) = 0 [pid 363] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 363] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 363] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 363] rt_sigprocmask(SIG_BLOCK, ~[], [pid 357] rt_sigprocmask(SIG_BLOCK, ~[], [pid 301] <... umount2 resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=361, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 363] <... rt_sigprocmask resumed>[], 8) = 0 [pid 363] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 357] <... rt_sigprocmask resumed>[], 8) = 0 [pid 301] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 363] <... clone3 resumed> => {parent_tid=[367]}, 88) = 367 [pid 363] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 357] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 363] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 363] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 363] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 363] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 363] rt_sigprocmask(SIG_BLOCK, ~[], [pid 301] newfstatat(AT_FDCWD, "./2/bus", [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 363] <... rt_sigprocmask resumed>[], 8) = 0 [pid 363] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 357] <... clone3 resumed> => {parent_tid=[368]}, 88) = 368 [pid 301] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 363] <... clone3 resumed> => {parent_tid=[369]}, 88) = 369 [pid 363] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 363] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] rt_sigprocmask(SIG_SETMASK, [], [pid 301] unlink("./2/bus" [pid 300] <... openat resumed>) = 3 [pid 363] <... futex resumed>) = 0 [pid 357] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 363] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... unlink resumed>) = 0 [pid 300] newfstatat(3, "", [pid 297] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 357] <... futex resumed>) = 0 [pid 301] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 357] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] getdents64(3, [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 357] <... futex resumed>) = 0 [pid 301] newfstatat(AT_FDCWD, "./2/binderfs", [pid 357] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 297] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 357] <... mmap resumed>) = 0x7f6220424000 [pid 301] unlink("./2/binderfs" [pid 300] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 357] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 301] <... unlink resumed>) = 0 [pid 297] <... openat resumed>) = 3 ./strace-static-x86_64: Process 368 attached [pid 357] <... mprotect resumed>) = 0 [pid 297] newfstatat(3, "", [pid 301] getdents64(3, [pid 300] <... umount2 resumed>) = 0 [pid 368] set_robust_list(0x7f62204659a0, 24 [pid 357] rt_sigprocmask(SIG_BLOCK, ~[], [pid 301] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 300] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 368] <... set_robust_list resumed>) = 0 [pid 357] <... rt_sigprocmask resumed>[], 8) = 0 [pid 301] close(3 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] getdents64(3, [pid 368] rt_sigprocmask(SIG_SETMASK, [], [pid 357] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 301] <... close resumed>) = 0 [pid 300] newfstatat(AT_FDCWD, "./2/bus", [pid 297] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 368] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] rmdir("./2" [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 368] memfd_create("syzkaller", 0 [pid 357] <... clone3 resumed> => {parent_tid=[370]}, 88) = 370 [pid 368] <... memfd_create resumed>) = 3 [pid 357] rt_sigprocmask(SIG_SETMASK, [], [pid 301] <... rmdir resumed>) = 0 [pid 300] unlink("./2/bus" [pid 297] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 369 attached ./strace-static-x86_64: Process 370 attached ./strace-static-x86_64: Process 367 attached [pid 368] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 357] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] mkdir("./3", 0777 [pid 300] <... unlink resumed>) = 0 [pid 297] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 370] set_robust_list(0x7f62204449a0, 24 [pid 369] set_robust_list(0x7f62204449a0, 24 [pid 368] <... mmap resumed>) = 0x7f6218024000 [pid 367] set_robust_list(0x7f62204659a0, 24 [pid 357] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... mkdir resumed>) = 0 [pid 300] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 370] <... set_robust_list resumed>) = 0 [pid 367] <... set_robust_list resumed>) = 0 [pid 357] <... futex resumed>) = 0 [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./2/bus", [pid 370] rt_sigprocmask(SIG_SETMASK, [], [pid 367] rt_sigprocmask(SIG_SETMASK, [], [pid 357] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... openat resumed>) = 3 [pid 300] newfstatat(AT_FDCWD, "./2/binderfs", [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 370] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 367] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] ioctl(3, LOOP_CLR_FD [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./2/bus" [pid 370] creat("./bus", 000 [pid 367] memfd_create("syzkaller", 0 [pid 301] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] unlink("./2/binderfs" [pid 370] <... creat resumed>) = 4 [pid 367] <... memfd_create resumed>) = 3 [pid 301] close(3 [pid 300] <... unlink resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 370] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 367] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 301] <... close resumed>) = 0 [pid 300] getdents64(3, [pid 297] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 370] <... futex resumed>) = 1 [pid 367] <... mmap resumed>) = 0x7f6218024000 [pid 357] <... futex resumed>) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 370] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 368] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 367] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 357] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] close(3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 370] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 369] <... set_robust_list resumed>) = 0 [pid 367] <... write resumed>) = 262144 [pid 357] <... futex resumed>) = 0 [pid 301] <... clone resumed>, child_tidptr=0x555556cc7690) = 371 [pid 300] <... close resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./2/binderfs", [pid 370] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 367] munmap(0x7f6218024000, 262144 [pid 357] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] rmdir("./2" [pid 370] <... mount resumed>) = 0 [pid 369] rt_sigprocmask(SIG_SETMASK, [], [pid 367] <... munmap resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 370] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 367] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 300] mkdir("./3", 0777 [pid 297] unlink("./2/binderfs" [pid 370] <... futex resumed>) = 1 [pid 369] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 367] <... openat resumed>) = 4 [pid 357] <... futex resumed>) = 0 [pid 300] <... mkdir resumed>) = 0 [pid 370] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 367] ioctl(4, LOOP_SET_FD, 3 [ 23.602385][ T355] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 23.612994][ T355] EXT4-fs error (device loop0): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # [pid 357] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] <... unlink resumed>) = 0 [pid 370] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 369] creat("./bus", 000 [pid 368] <... write resumed>) = 262144 [pid 357] <... futex resumed>) = 0 [pid 300] <... openat resumed>) = 3 [pid 297] getdents64(3, [pid 370] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 357] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] ioctl(3, LOOP_CLR_FD [pid 370] <... open resumed>) = 5 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 370] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] close(3 [pid 370] <... futex resumed>) = 1 [pid 369] <... creat resumed>) = 5 [pid 357] <... futex resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 370] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 357] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 369] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 371 attached [pid 370] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 368] munmap(0x7f6218024000, 262144 [pid 357] <... futex resumed>) = 0 [pid 370] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 369] <... futex resumed>) = 1 [pid 363] <... futex resumed>) = 0 [pid 357] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 372 [pid 297] close(3 [pid 370] <... socket resumed>) = 6 [pid 367] <... ioctl resumed>) = 0 ./strace-static-x86_64: Process 372 attached [pid 371] set_robust_list(0x555556cc76a0, 24 [pid 370] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 368] <... munmap resumed>) = 0 [pid 363] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... close resumed>) = 0 [pid 370] <... futex resumed>) = 1 [pid 367] close(3 [pid 357] <... futex resumed>) = 0 [pid 370] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 367] <... close resumed>) = 0 [pid 357] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 370] <... mmap resumed>) = 0x20000000 [pid 367] mkdir("./file0", 0777 [pid 357] <... futex resumed>) = 0 [pid 372] set_robust_list(0x555556cc76a0, 24 [pid 371] <... set_robust_list resumed>) = 0 [pid 370] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... mount resumed>) = 0 [pid 368] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 367] <... mkdir resumed>) = 0 [pid 363] <... futex resumed>) = 0 [pid 357] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] rmdir("./2" [pid 372] <... set_robust_list resumed>) = 0 [pid 371] chdir("./3" [pid 369] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 368] <... openat resumed>) = 7 [pid 363] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 370] <... futex resumed>) = 0 [pid 367] mount("/dev/loop2", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 357] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 370] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 357] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 363] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] <... rmdir resumed>) = 0 [pid 372] chdir("./3" [pid 363] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] <... futex resumed>) = ? [pid 371] <... chdir resumed>) = 0 [pid 369] <... futex resumed>) = 0 [pid 372] <... chdir resumed>) = 0 [pid 363] <... futex resumed>) = 0 [pid 371] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 297] mkdir("./3", 0777 [pid 372] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 371] <... prctl resumed>) = 0 [pid 369] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 368] +++ killed by SIGBUS +++ [pid 363] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 372] <... prctl resumed>) = 0 [pid 371] setpgid(0, 0 [pid 370] +++ killed by SIGBUS +++ [pid 369] <... open resumed>) = 3 [pid 357] +++ killed by SIGBUS +++ [pid 297] <... mkdir resumed>) = 0 [pid 372] setpgid(0, 0 [pid 371] <... setpgid resumed>) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=357, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 369] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 369] <... futex resumed>) = 1 [pid 363] <... futex resumed>) = 0 [pid 299] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 372] <... setpgid resumed>) = 0 [pid 371] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 369] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 363] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... openat resumed>) = 3 [pid 372] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 363] <... futex resumed>) = 0 [pid 369] <... socket resumed>) = 6 [pid 363] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 371] <... openat resumed>) = 3 [pid 372] <... openat resumed>) = 3 [pid 369] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] ioctl(3, LOOP_CLR_FD [pid 299] <... openat resumed>) = 3 [pid 371] write(3, "1000", 4 [pid 369] <... futex resumed>) = 1 [pid 363] <... futex resumed>) = 0 [pid 299] newfstatat(3, "", [pid 372] write(3, "1000", 4 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 363] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 372] <... write resumed>) = 4 [pid 371] <... write resumed>) = 4 [pid 369] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 3, 0 [pid 363] <... futex resumed>) = 0 [pid 372] close(3 [pid 299] getdents64(3, [pid 297] close(3 [pid 363] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 369] <... mmap resumed>) = 0x20000000 [pid 299] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 369] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] <... close resumed>) = 0 [pid 371] close(3 [pid 297] <... close resumed>) = 0 [pid 369] <... futex resumed>) = 1 [pid 363] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 371] <... close resumed>) = 0 [pid 372] symlink("/dev/binderfs", "./binderfs" [pid 369] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 363] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 371] symlink("/dev/binderfs", "./binderfs" [pid 369] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 363] <... futex resumed>) = 0 [pid 299] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 372] <... symlink resumed>) = 0 [pid 369] memfd_create("syzkaller", 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 371] <... symlink resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./2/bus", [pid 371] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... memfd_create resumed>) = 7 [pid 372] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 371] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 371] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 369] <... mmap resumed>) = 0x7f620fc64000 [pid 299] unlink("./2/bus" [pid 372] <... futex resumed>) = 0 [pid 371] <... rt_sigaction resumed>NULL, 8) = 0 [pid 299] <... unlink resumed>) = 0 [pid 372] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 371] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 299] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 372] <... rt_sigaction resumed>NULL, 8) = 0 [pid 371] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 372] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... clone resumed>, child_tidptr=0x555556cc7690) = 373 [pid 371] <... mmap resumed>) = 0x7f6220445000 [pid 372] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] newfstatat(AT_FDCWD, "./2/binderfs", [pid 372] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 371] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 372] <... mmap resumed>) = 0x7f6220445000 [pid 371] <... mprotect resumed>) = 0 [pid 299] unlink("./2/binderfs" [pid 372] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 355] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] <... unlink resumed>) = 0 [pid 372] <... mprotect resumed>) = 0 [pid 371] rt_sigprocmask(SIG_BLOCK, ~[], [pid 372] rt_sigprocmask(SIG_BLOCK, ~[], [pid 371] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] getdents64(3, [pid 372] <... rt_sigprocmask resumed>[], 8) = 0 [pid 371] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 299] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 355] ioctl(4, LOOP_CLR_FD [pid 372] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 355] <... ioctl resumed>) = 0 [pid 355] close(4 [pid 371] <... clone3 resumed> => {parent_tid=[374]}, 88) = 374 [pid 299] close(3 [pid 372] <... clone3 resumed> => {parent_tid=[375]}, 88) = 375 [pid 355] <... close resumed>) = 0 [pid 355] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] rt_sigprocmask(SIG_SETMASK, [], [pid 372] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... close resumed>) = 0 [pid 355] <... futex resumed>) = 0 [pid 355] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] rmdir("./2" [pid 372] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 371] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 372] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] exit_group(0 [pid 356] <... futex resumed>) = ? [pid 350] <... exit_group resumed>) = ? [pid 372] <... futex resumed>) = 0 [pid 371] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] +++ exited with 0 +++ [pid 299] mkdir("./3", 0777 [pid 355] <... futex resumed>) = ? [pid 372] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] <... futex resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 372] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 371] <... mmap resumed>) = 0x7f6220424000 [pid 372] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 371] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 299] <... openat resumed>) = 3 [pid 372] <... mmap resumed>) = 0x7f6220424000 [pid 371] <... mprotect resumed>) = 0 [pid 372] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 299] ioctl(3, LOOP_CLR_FD [pid 372] <... mprotect resumed>) = 0 [pid 371] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 371] <... rt_sigprocmask resumed>[], 8) = 0 [pid 372] rt_sigprocmask(SIG_BLOCK, ~[], [pid 371] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 299] close(3 [pid 372] <... rt_sigprocmask resumed>[], 8) = 0 [pid 371] <... clone3 resumed> => {parent_tid=[376]}, 88) = 376 [pid 299] <... close resumed>) = 0 [pid 372] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 371] rt_sigprocmask(SIG_SETMASK, [], [pid 369] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 371] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 372] <... clone3 resumed> => {parent_tid=[377]}, 88) = 377 [pid 371] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] rt_sigprocmask(SIG_SETMASK, [], [pid 371] <... futex resumed>) = 0 [pid 372] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 371] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... clone resumed>, child_tidptr=0x555556cc7690) = 378 ./strace-static-x86_64: Process 378 attached ./strace-static-x86_64: Process 377 attached ./strace-static-x86_64: Process 376 attached ./strace-static-x86_64: Process 375 attached ./strace-static-x86_64: Process 374 attached ./strace-static-x86_64: Process 373 attached [pid 372] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... write resumed>) = 65536 [pid 367] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 378] set_robust_list(0x555556cc76a0, 24 [pid 375] set_robust_list(0x7f62204659a0, 24 [pid 374] set_robust_list(0x7f62204659a0, 24 [pid 373] set_robust_list(0x555556cc76a0, 24 [pid 372] <... futex resumed>) = 0 [pid 369] munmap(0x7f620fc64000, 65536 [pid 367] ioctl(4, LOOP_CLR_FD [pid 378] <... set_robust_list resumed>) = 0 [pid 367] <... ioctl resumed>) = 0 [pid 367] close(4 [pid 369] <... munmap resumed>) = 0 [pid 367] <... close resumed>) = 0 [pid 374] <... set_robust_list resumed>) = 0 [pid 372] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 375] <... set_robust_list resumed>) = 0 [pid 374] rt_sigprocmask(SIG_SETMASK, [], [pid 375] rt_sigprocmask(SIG_SETMASK, [], [pid 373] <... set_robust_list resumed>) = 0 [pid 378] chdir("./3" [pid 375] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 374] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 373] chdir("./3" [pid 367] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 374] memfd_create("syzkaller", 0 [pid 367] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 375] memfd_create("syzkaller", 0 [pid 369] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 374] <... memfd_create resumed>) = 3 [pid 375] <... memfd_create resumed>) = 3 [pid 373] <... chdir resumed>) = 0 [pid 378] <... chdir resumed>) = 0 [pid 369] <... openat resumed>) = 4 [pid 375] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 374] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 378] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 377] set_robust_list(0x7f62204449a0, 24 [pid 376] set_robust_list(0x7f62204449a0, 24 [pid 375] <... mmap resumed>) = 0x7f6218024000 [pid 374] <... mmap resumed>) = 0x7f6218024000 [pid 373] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 369] ioctl(4, LOOP_SET_FD, 7 [pid 378] <... prctl resumed>) = 0 [pid 377] <... set_robust_list resumed>) = 0 [pid 377] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 375] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 377] creat("./bus", 000) = 4 [pid 377] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 372] <... futex resumed>) = 0 [pid 377] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 372] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... mount resumed>) = 0 [pid 372] <... futex resumed>) = 0 [pid 377] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 377] <... futex resumed>) = 0 [pid 372] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 377] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 372] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... open resumed>) = 5 [pid 374] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 373] <... prctl resumed>) = 0 [pid 372] <... futex resumed>) = 0 [pid 369] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 378] setpgid(0, 0 [pid 377] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 377] <... futex resumed>) = 0 [pid 372] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 377] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 372] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... socket resumed>) = 6 [pid 372] <... futex resumed>) = 0 [pid 377] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 372] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 377] <... futex resumed>) = 0 [pid 372] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 377] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 372] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... setpgid resumed>) = 0 [pid 377] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 373] setpgid(0, 0 [pid 372] <... futex resumed>) = 0 [pid 369] ioctl(4, LOOP_CLR_FD [pid 377] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 372] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 377] <... mmap resumed>) = 0x20000000 [pid 369] <... ioctl resumed>) = 0 [pid 378] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 377] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] <... setpgid resumed>) = 0 [pid 377] <... futex resumed>) = 1 [pid 372] <... futex resumed>) = 0 [pid 377] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 372] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 372] <... futex resumed>) = 0 [pid 377] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 372] read(542316032, [pid 376] <... set_robust_list resumed>) = 0 [pid 376] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 373] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 376] creat("./bus", 000 [pid 378] <... openat resumed>) = 3 [pid 376] <... creat resumed>) = 4 [pid 373] <... openat resumed>) = 3 [pid 376] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 371] <... futex resumed>) = 0 [pid 376] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 371] <... futex resumed>) = 0 [pid 376] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 371] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] <... mount resumed>) = 0 [pid 376] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] <... write resumed>) = 262144 [pid 373] write(3, "1000", 4 [pid 378] write(3, "1000", 4 [pid 376] <... futex resumed>) = 1 [pid 371] <... futex resumed>) = 0 [pid 376] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 371] <... futex resumed>) = 0 [pid 376] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 371] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] <... open resumed>) = 5 [pid 376] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] <... write resumed>) = 4 [pid 369] ioctl(4, LOOP_SET_FD, 7 [pid 378] <... write resumed>) = 4 [pid 376] <... futex resumed>) = 1 [pid 375] <... write resumed>) = ? [pid 371] <... futex resumed>) = 0 [pid 376] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 371] <... futex resumed>) = 0 [pid 376] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 371] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] <... socket resumed>) = 6 [pid 369] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 378] close(3 [pid 376] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] +++ killed by SIGBUS +++ [pid 374] munmap(0x7f6218024000, 262144 [pid 373] close(3 [pid 369] close(4 [pid 378] <... close resumed>) = 0 [pid 377] +++ killed by SIGBUS +++ [pid 376] <... futex resumed>) = 1 [pid 374] <... munmap resumed>) = 0 [pid 373] <... close resumed>) = 0 [pid 372] +++ killed by SIGBUS +++ [pid 371] <... futex resumed>) = 0 [pid 369] <... close resumed>) = 0 [pid 378] symlink("/dev/binderfs", "./binderfs" [pid 376] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 374] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 373] symlink("/dev/binderfs", "./binderfs" [pid 371] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] close(7 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=372, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 371] <... futex resumed>) = 0 [pid 376] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 371] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 378] <... symlink resumed>) = 0 [pid 376] <... mmap resumed>) = 0x20000000 [pid 376] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 371] <... futex resumed>) = 0 [pid 369] <... close resumed>) = 0 [pid 376] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 373] <... symlink resumed>) = 0 [pid 371] <... futex resumed>) = 0 [pid 369] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 374] <... openat resumed>) = ? [pid 373] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 369] <... futex resumed>) = 0 [pid 378] <... futex resumed>) = 0 [pid 373] <... futex resumed>) = 0 [pid 369] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 378] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 374] +++ killed by SIGBUS +++ [pid 373] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 378] <... rt_sigaction resumed>NULL, 8) = 0 [pid 376] +++ killed by SIGBUS +++ [pid 373] <... rt_sigaction resumed>NULL, 8) = 0 [pid 371] +++ killed by SIGBUS +++ [pid 363] exit_group(0 [pid 378] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 373] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 369] <... futex resumed>) = ? [pid 367] <... futex resumed>) = ? [pid 363] <... exit_group resumed>) = ? [pid 378] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 373] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 369] +++ exited with 0 +++ [pid 367] +++ exited with 0 +++ [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=371, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 300] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 378] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 373] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 301] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 378] <... mmap resumed>) = 0x7f6220445000 [pid 373] <... mmap resumed>) = 0x7f6220445000 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 378] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 373] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 301] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 378] <... mprotect resumed>) = 0 [pid 373] <... mprotect resumed>) = 0 [pid 300] <... openat resumed>) = 3 [pid 301] <... openat resumed>) = 3 [pid 378] rt_sigprocmask(SIG_BLOCK, ~[], [pid 373] rt_sigprocmask(SIG_BLOCK, ~[], [pid 301] newfstatat(3, "", [pid 300] newfstatat(3, "", [pid 378] <... rt_sigprocmask resumed>[], 8) = 0 [pid 373] <... rt_sigprocmask resumed>[], 8) = 0 [pid 378] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 373] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 301] getdents64(3, [pid 300] getdents64(3, ./strace-static-x86_64: Process 379 attached [pid 379] set_robust_list(0x7f62204659a0, 24) = 0 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 379] rt_sigprocmask(SIG_SETMASK, [], [pid 300] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 378] <... clone3 resumed> => {parent_tid=[379]}, 88) = 379 [pid 373] <... clone3 resumed> => {parent_tid=[380]}, 88) = 380 [pid 301] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 378] rt_sigprocmask(SIG_SETMASK, [], [pid 373] rt_sigprocmask(SIG_SETMASK, [], [pid 300] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 378] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 373] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] <... umount2 resumed>) = 0 [pid 378] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = 0 [pid 378] <... futex resumed>) = 0 [pid 373] <... futex resumed>) = 0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 378] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] newfstatat(AT_FDCWD, "./3/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 378] <... futex resumed>) = 0 [pid 373] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] unlink("./3/bus" [pid 300] newfstatat(AT_FDCWD, "./3/bus", [pid 378] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 373] <... futex resumed>) = 0 [pid 379] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 379] memfd_create("syzkaller", 0 [pid 301] <... unlink resumed>) = 0 [pid 378] <... mmap resumed>) = 0x7f6220424000 [pid 373] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 301] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 378] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 373] <... mmap resumed>) = 0x7f6220424000 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] unlink("./3/bus" [pid 378] <... mprotect resumed>) = 0 [pid 373] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 301] newfstatat(AT_FDCWD, "./3/binderfs", [pid 379] <... memfd_create resumed>) = 3 [pid 300] <... unlink resumed>) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 373] <... mprotect resumed>) = 0 [pid 379] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 301] unlink("./3/binderfs" [pid 378] rt_sigprocmask(SIG_BLOCK, ~[], [pid 373] rt_sigprocmask(SIG_BLOCK, ~[], [pid 300] newfstatat(AT_FDCWD, "./3/binderfs", [pid 379] <... mmap resumed>) = 0x7f6218024000 [pid 301] <... unlink resumed>) = 0 [pid 373] <... rt_sigprocmask resumed>[], 8) = 0 [pid 301] getdents64(3, [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 378] <... rt_sigprocmask resumed>[], 8) = 0 [pid 373] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 378] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 301] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 300] unlink("./3/binderfs"./strace-static-x86_64: Process 381 attached [pid 379] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 301] close(3 [pid 300] <... unlink resumed>) = 0 [pid 378] <... clone3 resumed> => {parent_tid=[382]}, 88) = 382 [pid 373] <... clone3 resumed> => {parent_tid=[381]}, 88) = 381 [pid 301] <... close resumed>) = 0 [pid 300] getdents64(3, [pid 378] rt_sigprocmask(SIG_SETMASK, [], [pid 373] rt_sigprocmask(SIG_SETMASK, [], [pid 301] rmdir("./3" [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 378] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 373] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 381] set_robust_list(0x7f62204449a0, 24 [pid 379] <... write resumed>) = 262144 [pid 378] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... rmdir resumed>) = 0 [pid 300] close(3 [pid 379] munmap(0x7f6218024000, 262144 [pid 378] <... futex resumed>) = 0 [pid 373] <... futex resumed>) = 0 [pid 301] mkdir("./4", 0777 [pid 300] <... close resumed>) = 0 [pid 378] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 379] <... munmap resumed>) = 0 ./strace-static-x86_64: Process 380 attached [pid 379] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 380] set_robust_list(0x7f62204659a0, 24 [pid 301] <... mkdir resumed>) = 0 [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 300] rmdir("./3" [pid 379] <... openat resumed>) = 4 [pid 301] <... openat resumed>) = 3 [pid 380] <... set_robust_list resumed>) = 0 [pid 380] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 23.645472][ T367] loop2: detected capacity change from 0 to 512 [ 23.655981][ T355] EXT4-fs (loop0): get orphan inode failed [ 23.668679][ T355] EXT4-fs (loop0): mount failed [ 23.677799][ T367] EXT4-fs warning (device loop2): read_mmp_block:115: Error -74 while reading MMP block 12 [pid 379] ioctl(4, LOOP_SET_FD, 3 [pid 380] memfd_create("syzkaller", 0 [pid 301] ioctl(3, LOOP_CLR_FD [pid 300] <... rmdir resumed>) = 0 [pid 301] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] mkdir("./4", 0777 [pid 301] close(3 [pid 381] <... set_robust_list resumed>) = 0 [pid 379] <... ioctl resumed>) = 0 [pid 301] <... close resumed>) = 0 [pid 300] <... mkdir resumed>) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 380] <... memfd_create resumed>) = 3 [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 380] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218024000 ./strace-static-x86_64: Process 383 attached ./strace-static-x86_64: Process 382 attached [pid 381] rt_sigprocmask(SIG_SETMASK, [], [pid 379] close(3 [pid 300] <... openat resumed>) = 3 [pid 383] set_robust_list(0x555556cc76a0, 24 [pid 382] set_robust_list(0x7f62204449a0, 24 [pid 381] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] <... clone resumed>, child_tidptr=0x555556cc7690) = 383 [pid 300] ioctl(3, LOOP_CLR_FD [pid 383] <... set_robust_list resumed>) = 0 [pid 382] <... set_robust_list resumed>) = 0 [pid 381] creat("./bus", 000 [pid 363] +++ exited with 0 +++ [pid 355] +++ exited with 0 +++ [pid 350] +++ exited with 0 +++ [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 383] chdir("./4" [pid 382] rt_sigprocmask(SIG_SETMASK, [], [pid 381] <... creat resumed>) = 4 [pid 300] close(3 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=363, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=350, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 383] <... chdir resumed>) = 0 [pid 382] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 381] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... close resumed>) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 383] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 382] creat("./bus", 000 [pid 381] <... futex resumed>) = 1 [pid 379] <... close resumed>) = 0 [pid 373] <... futex resumed>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... restart_syscall resumed>) = 0 [pid 296] <... restart_syscall resumed>) = 0 [pid 383] <... prctl resumed>) = 0 [pid 382] <... creat resumed>) = 3 [pid 381] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 379] mkdir("./file0", 0777 [pid 373] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 383] setpgid(0, 0 [pid 382] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 379] <... mkdir resumed>) = 0 [pid 373] <... futex resumed>) = 0 [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 384 [pid 383] <... setpgid resumed>) = 0 [pid 382] <... futex resumed>) = 1 [pid 381] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 380] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 379] mount("/dev/loop3", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 378] <... futex resumed>) = 0 [pid 373] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 382] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 381] <... mount resumed>) = 0 [pid 380] <... write resumed>) = 262144 [pid 378] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] <... openat resumed>) = 3 [pid 382] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 381] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 383] write(3, "1000", 4 [pid 382] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 381] <... futex resumed>) = 1 [pid 378] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 383] <... write resumed>) = 4 [pid 382] <... mount resumed>) = 0 [pid 381] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 373] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(3, "", [pid 296] newfstatat(3, "", [pid 383] close(3 [pid 382] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 373] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 383] <... close resumed>) = 0 [pid 382] <... futex resumed>) = 1 [pid 381] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 380] munmap(0x7f6218024000, 262144 [pid 378] <... futex resumed>) = 0 [pid 373] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(3, [pid 296] getdents64(3, ./strace-static-x86_64: Process 384 attached [pid 383] symlink("/dev/binderfs", "./binderfs" [pid 382] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 381] <... open resumed>) = 5 [pid 380] <... munmap resumed>) = 0 [pid 378] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 384] set_robust_list(0x555556cc76a0, 24 [pid 383] <... symlink resumed>) = 0 [pid 382] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 381] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 298] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 384] <... set_robust_list resumed>) = 0 [pid 383] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 382] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 381] <... futex resumed>) = 1 [pid 380] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 378] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 384] chdir("./4" [pid 383] <... futex resumed>) = 0 [pid 382] <... open resumed>) = 5 [pid 381] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 373] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 384] <... chdir resumed>) = 0 [pid 383] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 382] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 380] <... openat resumed>) = 6 [pid 373] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 384] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 383] <... rt_sigaction resumed>NULL, 8) = 0 [pid 382] <... futex resumed>) = 1 [pid 381] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 380] ioctl(6, LOOP_SET_FD, 3 [pid 378] <... futex resumed>) = 0 [pid 373] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] newfstatat(AT_FDCWD, "./2/bus", [pid 296] newfstatat(AT_FDCWD, "./2/bus", [pid 384] <... prctl resumed>) = 0 [pid 383] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 382] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 381] <... socket resumed>) = 7 [pid 378] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 383] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 382] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 381] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 298] unlink("./2/bus" [pid 296] unlink("./2/bus" [pid 383] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 382] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 381] <... futex resumed>) = 1 [pid 378] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 383] <... mmap resumed>) = 0x7f6220445000 [pid 382] <... socket resumed>) = 6 [pid 381] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 373] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 382] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 373] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] <... mprotect resumed>) = 0 [pid 382] <... futex resumed>) = 1 [pid 381] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 378] <... futex resumed>) = 0 [pid 373] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] newfstatat(AT_FDCWD, "./2/binderfs", [pid 296] newfstatat(AT_FDCWD, "./2/binderfs", [pid 384] setpgid(0, 0 [pid 383] rt_sigprocmask(SIG_BLOCK, ~[], [pid 382] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 381] <... mmap resumed>) = 0x20000000 [pid 378] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 384] <... setpgid resumed>) = 0 [pid 383] <... rt_sigprocmask resumed>[], 8) = 0 [pid 382] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 381] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 378] <... futex resumed>) = 0 [pid 298] unlink("./2/binderfs" [pid 296] unlink("./2/binderfs" [pid 384] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 383] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 382] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 381] <... futex resumed>) = 1 [pid 378] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 373] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 382] <... mmap resumed>) = 0x20000000 [pid 381] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 373] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 383] <... clone3 resumed> => {parent_tid=[387]}, 88) = 387 [ 23.720091][ T379] loop3: detected capacity change from 0 to 512 [ 23.754520][ T380] loop1: detected capacity change from 0 to 512 [pid 382] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 373] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 384] <... openat resumed>) = 3 [pid 383] rt_sigprocmask(SIG_SETMASK, [], [pid 382] <... futex resumed>) = 1 [pid 380] <... ioctl resumed>) = 0 [pid 378] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./2/file0", [pid 296] newfstatat(AT_FDCWD, "./2/file0", [pid 384] write(3, "1000", 4 [pid 383] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 382] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 378] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 383] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 382] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 378] <... futex resumed>) = 0 [pid 298] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 384] <... write resumed>) = 4 [pid 383] <... futex resumed>) = 0 [pid 382] memfd_create("syzkaller", 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 383] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 382] <... memfd_create resumed>) = 7 [pid 298] openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 383] <... futex resumed>) = 0 [pid 382] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 298] <... openat resumed>) = 4 [pid 296] <... openat resumed>) = 4 [pid 383] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 382] <... mmap resumed>) = 0x7f620fc64000 [pid 298] newfstatat(4, "", [pid 296] newfstatat(4, "", [pid 384] close(3 [pid 383] <... mmap resumed>) = 0x7f6220424000 [pid 380] close(3 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 384] <... close resumed>) = 0 [pid 383] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 380] <... close resumed>) = 0 [pid 298] getdents64(4, [pid 296] getdents64(4, [pid 384] symlink("/dev/binderfs", "./binderfs" [pid 383] <... mprotect resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 296] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 383] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] getdents64(4, [pid 296] getdents64(4, [pid 383] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 296] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 383] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 298] close(4 [pid 296] close(4 [pid 298] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 384] <... symlink resumed>) = 0 [pid 383] <... clone3 resumed> => {parent_tid=[388]}, 88) = 388 [pid 298] rmdir("./2/file0" [pid 296] rmdir("./2/file0" [pid 384] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 383] rt_sigprocmask(SIG_SETMASK, [], [pid 380] mkdir(0x20000000, 0777 [pid 298] <... rmdir resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 384] <... futex resumed>) = 0 [pid 383] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] getdents64(3, [pid 296] getdents64(3, [pid 384] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 383] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 384] <... rt_sigaction resumed>NULL, 8) = 0 [pid 383] <... futex resumed>) = 0 [pid 298] close(3 [pid 296] close(3 [pid 384] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 383] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 384] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] rmdir("./2" [pid 296] rmdir("./2" [pid 384] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... rmdir resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 298] mkdir("./3", 0777 [pid 296] mkdir("./3", 0777 [pid 384] <... mmap resumed>) = 0x7f6220445000 [pid 298] <... mkdir resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 384] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 384] <... mprotect resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 384] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] ioctl(3, LOOP_CLR_FD [pid 296] ioctl(3, LOOP_CLR_FD [pid 384] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 384] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 298] close(3 [pid 296] close(3 [pid 298] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 384] <... clone3 resumed> => {parent_tid=[390]}, 88) = 390 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 384] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 391 [pid 296] <... clone resumed>, child_tidptr=0x555556cc7690) = 392 ./strace-static-x86_64: Process 387 attached [pid 384] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 384] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 384] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 384] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[393]}, 88) = 393 [pid 384] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 384] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 387] set_robust_list(0x7f62204659a0, 24 [pid 382] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 68515) = 68515 [pid 382] munmap(0x7f620fc64000, 68515) = 0 [pid 382] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 8 [pid 382] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 382] ioctl(8, LOOP_CLR_FD [pid 387] <... set_robust_list resumed>) = 0 [pid 387] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 382] <... ioctl resumed>) = 0 ./strace-static-x86_64: Process 393 attached [pid 387] memfd_create("syzkaller", 0 [pid 393] set_robust_list(0x7f62204449a0, 24 [pid 387] <... memfd_create resumed>) = 3 [pid 387] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 393] <... set_robust_list resumed>) = 0 [pid 393] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 393] creat("./bus", 000 [pid 387] <... mmap resumed>) = 0x7f6218024000 [pid 382] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 382] close(8) = 0 [pid 382] close(7 [pid 387] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 382] <... close resumed>) = 0 [pid 382] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 382] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 393] <... creat resumed>) = 3 [ 23.764932][ T381] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 0 [ 23.778762][ T379] EXT4-fs error (device loop3): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # ./strace-static-x86_64: Process 390 attached [pid 393] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 388 attached [pid 388] set_robust_list(0x7f62204449a0, 24 [pid 381] memfd_create("syzkaller", 0 [pid 388] <... set_robust_list resumed>) = 0 [pid 388] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 388] creat("./bus", 000 [pid 381] <... memfd_create resumed>) = 3 [pid 381] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f620fc64000 [pid 388] <... creat resumed>) = 4 [pid 388] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 383] <... futex resumed>) = 0 [pid 383] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 381] <... write resumed>) = 65536 [pid 388] <... futex resumed>) = 1 [pid 388] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 388] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 383] <... futex resumed>) = 0 [pid 383] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... futex resumed>) = 1 [pid 388] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 381] munmap(0x7f620fc64000, 65536 [pid 388] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] <... mkdir resumed>) = 0 [pid 383] <... futex resumed>) = 0 [pid 381] <... munmap resumed>) = 0 [pid 383] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 381] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 380] mount("/dev/loop1", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 383] <... futex resumed>) = 0 [pid 383] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... futex resumed>) = 1 [pid 388] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE) = 6 [pid 388] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 383] <... futex resumed>) = 0 [pid 383] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... futex resumed>) = 1 [pid 388] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000 [pid 388] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 383] <... futex resumed>) = 0 [pid 383] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 388] <... futex resumed>) = 1 [pid 388] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 381] <... openat resumed>) = 8 [pid 381] ioctl(8, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 380] <... mount resumed>) = -1 ENODEV (No such device) [pid 381] ioctl(8, LOOP_CLR_FD [pid 380] ioctl(6, LOOP_CLR_FD [pid 381] <... ioctl resumed>) = 0 [pid 380] <... ioctl resumed>) = 0 [pid 380] close(6) = 0 [pid 380] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 381] ioctl(8, LOOP_SET_FD, 3) = -1 EBUSY (Device or resource busy) [pid 381] close(8) = 0 [pid 381] close(3) = 0 [pid 381] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 393] <... futex resumed>) = 1 [pid 390] set_robust_list(0x7f62204659a0, 24 [pid 384] <... futex resumed>) = 0 [pid 373] exit_group(0 [pid 384] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 381] <... futex resumed>) = ? [pid 373] <... exit_group resumed>) = ? [pid 380] <... futex resumed>) = ? [pid 384] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 381] +++ exited with 0 +++ [pid 380] +++ exited with 0 +++ [pid 390] <... set_robust_list resumed>) = 0 [pid 393] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 390] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 392 attached ./strace-static-x86_64: Process 391 attached NULL, 8) = 0 [pid 393] <... mount resumed>) = 0 [pid 387] <... write resumed>) = ? [pid 393] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 390] memfd_create("syzkaller", 0 [pid 392] set_robust_list(0x555556cc76a0, 24 [pid 393] <... futex resumed>) = 1 [pid 391] set_robust_list(0x555556cc76a0, 24 [pid 384] <... futex resumed>) = 0 [pid 384] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 390] <... memfd_create resumed>) = 4 [pid 393] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 392] <... set_robust_list resumed>) = 0 [pid 391] <... set_robust_list resumed>) = 0 [pid 390] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 393] <... open resumed>) = 5 [pid 390] <... mmap resumed>) = 0x7f6218024000 [pid 392] chdir("./3" [pid 390] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 393] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 384] <... futex resumed>) = 0 [pid 392] <... chdir resumed>) = 0 [pid 384] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 393] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 392] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 390] <... write resumed>) = 262144 [pid 393] <... socket resumed>) = 6 [pid 392] <... prctl resumed>) = 0 [pid 391] chdir("./3" [pid 390] munmap(0x7f6218024000, 262144 [pid 393] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 384] <... futex resumed>) = 0 [pid 392] setpgid(0, 0 [pid 384] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 384] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 393] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 392] <... setpgid resumed>) = 0 [pid 391] <... chdir resumed>) = 0 [pid 390] <... munmap resumed>) = 0 [pid 393] <... mmap resumed>) = 0x20000000 [pid 392] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 393] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 391] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 384] <... futex resumed>) = 0 [pid 393] <... futex resumed>) = 1 [pid 392] <... openat resumed>) = 3 [pid 391] <... prctl resumed>) = 0 [pid 384] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 392] write(3, "1000", 4 [pid 391] setpgid(0, 0 [pid 392] <... write resumed>) = 4 [pid 391] <... setpgid resumed>) = 0 [pid 392] close(3 [pid 390] +++ killed by SIGBUS +++ [pid 393] +++ killed by SIGBUS +++ [pid 384] +++ killed by SIGBUS +++ [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=384, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 392] <... close resumed>) = 0 [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 391] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 392] symlink("/dev/binderfs", "./binderfs") = 0 [pid 391] <... openat resumed>) = 3 [pid 392] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... restart_syscall resumed>) = 0 [pid 388] +++ killed by SIGBUS +++ [pid 300] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 300] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 300] getdents64(3, 0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 300] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 387] +++ killed by SIGBUS +++ [pid 383] +++ killed by SIGBUS +++ [pid 300] <... umount2 resumed>) = 0 [pid 392] <... futex resumed>) = 0 [pid 391] write(3, "1000", 4 [pid 300] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=383, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 300] newfstatat(AT_FDCWD, "./4/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] unlink("./4/bus" [pid 301] <... restart_syscall resumed>) = 0 [pid 300] <... unlink resumed>) = 0 [pid 392] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 391] <... write resumed>) = 4 [pid 300] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 392] <... rt_sigaction resumed>NULL, 8) = 0 [pid 391] close(3 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 301] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] newfstatat(AT_FDCWD, "./4/binderfs", [pid 392] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 391] <... close resumed>) = 0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] unlink("./4/binderfs" [pid 392] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 391] symlink("/dev/binderfs", "./binderfs" [pid 301] <... openat resumed>) = 3 [pid 392] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 301] newfstatat(3, "", [pid 300] <... unlink resumed>) = 0 [pid 392] <... mmap resumed>) = 0x7f6220445000 [pid 391] <... symlink resumed>) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 301] getdents64(3, [pid 300] getdents64(3, [pid 392] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 391] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 392] <... mprotect resumed>) = 0 [pid 391] <... futex resumed>) = 0 [pid 301] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] close(3 [pid 392] rt_sigprocmask(SIG_BLOCK, ~[], [pid 391] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 301] <... umount2 resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 392] <... rt_sigprocmask resumed>[], 8) = 0 [pid 301] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] rmdir("./4" [pid 392] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 391] <... rt_sigaction resumed>NULL, 8) = 0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... rmdir resumed>) = 0 [pid 391] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 301] newfstatat(AT_FDCWD, "./4/bus", [pid 300] mkdir("./5", 0777 [pid 392] <... clone3 resumed> => {parent_tid=[395]}, 88) = 395 [pid 391] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] <... mkdir resumed>) = 0 [pid 301] unlink("./4/bus" [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 301] <... unlink resumed>) = 0 [pid 300] <... openat resumed>) = 3 [pid 301] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] ioctl(3, LOOP_CLR_FD [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 301] newfstatat(AT_FDCWD, "./4/binderfs", [pid 300] close(3 [pid 301] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] <... close resumed>) = 0 [pid 301] unlink("./4/binderfs" [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 301] <... unlink resumed>) = 0 [pid 301] getdents64(3, [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 396 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 301] close(3) = 0 [pid 301] rmdir("./4") = 0 [pid 301] mkdir("./5", 0777) = 0 [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 301] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 301] close(3) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 397 ./strace-static-x86_64: Process 395 attached [pid 395] set_robust_list(0x7f62204659a0, 24) = 0 [pid 395] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 392] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 391] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 392] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 391] <... mmap resumed>) = 0x7f6220445000 [pid 392] <... futex resumed>) = 0 [pid 392] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 391] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 392] <... futex resumed>) = 0 [pid 391] <... mprotect resumed>) = 0 [pid 392] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 391] rt_sigprocmask(SIG_BLOCK, ~[], [pid 392] <... mmap resumed>) = 0x7f6220424000 [pid 391] <... rt_sigprocmask resumed>[], 8) = 0 [pid 392] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 391] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 392] <... mprotect resumed>) = 0 [pid 395] memfd_create("syzkaller", 0 [pid 392] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 391] <... clone3 resumed> => {parent_tid=[398]}, 88) = 398 [pid 392] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 391] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 392] <... clone3 resumed> => {parent_tid=[399]}, 88) = 399 [pid 391] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 399 attached ./strace-static-x86_64: Process 398 attached ./strace-static-x86_64: Process 397 attached ./strace-static-x86_64: Process 396 attached [pid 395] <... memfd_create resumed>) = 3 [pid 392] rt_sigprocmask(SIG_SETMASK, [], [pid 391] <... futex resumed>) = 0 [pid 399] set_robust_list(0x7f62204449a0, 24 [pid 396] set_robust_list(0x555556cc76a0, 24 [pid 392] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 391] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 398] set_robust_list(0x7f62204659a0, 24 [pid 397] set_robust_list(0x555556cc76a0, 24 [pid 395] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 379] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 379] ioctl(4, LOOP_CLR_FD) = 0 [pid 379] close(4) = 0 [pid 379] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 373] +++ exited with 0 +++ [pid 399] <... set_robust_list resumed>) = 0 [pid 398] <... set_robust_list resumed>) = 0 [pid 397] <... set_robust_list resumed>) = 0 [pid 396] <... set_robust_list resumed>) = 0 [pid 395] <... mmap resumed>) = 0x7f6218024000 [pid 392] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 391] <... futex resumed>) = 0 [pid 379] <... futex resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=373, si_uid=0, si_status=0, si_utime=1, si_stime=1} --- [pid 399] rt_sigprocmask(SIG_SETMASK, [], [pid 398] rt_sigprocmask(SIG_SETMASK, [], [pid 397] chdir("./5" [pid 396] chdir("./5" [pid 395] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 392] <... futex resumed>) = 0 [pid 391] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 378] exit_group(0 [pid 379] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 399] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 398] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 397] <... chdir resumed>) = 0 [pid 396] <... chdir resumed>) = 0 [pid 392] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 391] <... mmap resumed>) = 0x7f6220424000 [pid 399] creat("./bus", 000 [pid 398] memfd_create("syzkaller", 0 [pid 397] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 396] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 395] <... write resumed>) = 262144 [pid 391] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 382] <... futex resumed>) = ? [pid 379] <... futex resumed>) = ? [pid 378] <... exit_group resumed>) = ? [pid 399] <... creat resumed>) = 4 [pid 398] <... memfd_create resumed>) = 3 [pid 397] <... prctl resumed>) = 0 [pid 396] <... prctl resumed>) = 0 [pid 391] <... mprotect resumed>) = 0 [pid 399] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 398] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 397] setpgid(0, 0 [pid 396] setpgid(0, 0 [pid 391] rt_sigprocmask(SIG_BLOCK, ~[], [pid 399] <... futex resumed>) = 1 [pid 398] <... mmap resumed>) = 0x7f6218024000 [pid 397] <... setpgid resumed>) = 0 [pid 396] <... setpgid resumed>) = 0 [pid 392] <... futex resumed>) = 0 [pid 391] <... rt_sigprocmask resumed>[], 8) = 0 [pid 382] +++ exited with 0 +++ [pid 297] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 399] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 398] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 397] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 396] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 395] munmap(0x7f6218024000, 262144 [pid 392] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 391] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 399] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 397] <... openat resumed>) = 3 [pid 396] <... openat resumed>) = 3 [pid 395] <... munmap resumed>) = 0 [pid 392] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 399] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 397] write(3, "1000", 4 [pid 396] write(3, "1000", 4 [pid 395] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 392] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 391] <... clone3 resumed> => {parent_tid=[400]}, 88) = 400 [pid 297] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 399] <... mount resumed>) = 0 [pid 397] <... write resumed>) = 4 [pid 396] <... write resumed>) = 4 [pid 395] <... openat resumed>) = 5 [pid 391] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... openat resumed>) = 3 [pid 399] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 397] close(3 [pid 396] close(3 [pid 395] ioctl(5, LOOP_SET_FD, 3 [pid 391] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] newfstatat(3, "", ./strace-static-x86_64: Process 400 attached [pid 399] <... futex resumed>) = 1 [pid 398] <... write resumed>) = 262144 [ 23.811366][ T379] EXT4-fs (loop3): get orphan inode failed [ 23.841115][ T379] EXT4-fs (loop3): mount failed [pid 397] <... close resumed>) = 0 [pid 396] <... close resumed>) = 0 [pid 392] <... futex resumed>) = 0 [pid 391] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 400] set_robust_list(0x7f62204449a0, 24 [pid 399] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 398] munmap(0x7f6218024000, 262144 [pid 397] symlink("/dev/binderfs", "./binderfs" [pid 396] symlink("/dev/binderfs", "./binderfs" [pid 392] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 391] <... futex resumed>) = 0 [pid 400] <... set_robust_list resumed>) = 0 [pid 399] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 398] <... munmap resumed>) = 0 [pid 397] <... symlink resumed>) = 0 [pid 396] <... symlink resumed>) = 0 [pid 392] <... futex resumed>) = 0 [pid 391] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 400] rt_sigprocmask(SIG_SETMASK, [], [pid 399] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 398] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 397] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 392] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 400] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 398] <... openat resumed>) = 4 [pid 397] <... futex resumed>) = 0 [pid 396] <... futex resumed>) = 0 [pid 400] creat("./bus", 000 [pid 398] ioctl(4, LOOP_SET_FD, 3 [pid 397] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 396] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 399] <... open resumed>) = 6 [pid 395] <... ioctl resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 399] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 395] close(3 [pid 297] getdents64(3, [pid 399] <... futex resumed>) = 1 [pid 395] <... close resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 128 [pid 399] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 395] mkdir("./file0", 0777 [pid 297] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 395] <... mkdir resumed>) = 0 [pid 395] mount("/dev/loop0", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 397] <... rt_sigaction resumed>NULL, 8) = 0 [pid 396] <... rt_sigaction resumed>NULL, 8) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 392] <... futex resumed>) = 0 [pid 397] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 396] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 392] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 399] <... futex resumed>) = 0 [pid 397] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 396] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 392] <... futex resumed>) = 1 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 399] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 398] <... ioctl resumed>) = 0 [pid 397] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 396] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 392] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] newfstatat(AT_FDCWD, "./3/bus", [pid 400] <... creat resumed>) = 5 [pid 399] <... socket resumed>) = 3 [pid 398] close(3 [pid 397] <... mmap resumed>) = 0x7f6220445000 [pid 396] <... mmap resumed>) = 0x7f6220445000 [pid 399] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 398] <... close resumed>) = 0 [pid 397] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 396] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 399] <... futex resumed>) = 1 [pid 398] mkdir("./file0", 0777 [pid 397] <... mprotect resumed>) = 0 [pid 396] <... mprotect resumed>) = 0 [pid 392] <... futex resumed>) = 0 [pid 297] unlink("./3/bus" [pid 399] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 397] rt_sigprocmask(SIG_BLOCK, ~[], [pid 396] rt_sigprocmask(SIG_BLOCK, ~[], [pid 392] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... unlink resumed>) = 0 [pid 399] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 399] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 397] <... rt_sigprocmask resumed>[], 8) = 0 [pid 396] <... rt_sigprocmask resumed>[], 8) = 0 [pid 392] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 399] <... mmap resumed>) = 0x20000000 [pid 397] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 396] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 392] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 398] <... mkdir resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./3/binderfs", [pid 399] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 392] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 400] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] <... futex resumed>) = 0 [pid 398] mount("/dev/loop2", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 397] <... clone3 resumed> => {parent_tid=[402]}, 88) = 402 [pid 392] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] unlink("./3/binderfs" [pid 400] <... futex resumed>) = 1 [pid 399] memfd_create("syzkaller", 0 [pid 397] rt_sigprocmask(SIG_SETMASK, [], [pid 396] <... clone3 resumed> => {parent_tid=[403]}, 88) = 403 [pid 392] <... futex resumed>) = 0 [pid 391] <... futex resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 400] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 399] <... memfd_create resumed>) = 7 [pid 397] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 396] rt_sigprocmask(SIG_SETMASK, [], [pid 391] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./3/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 399] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 397] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 391] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 403 attached ./strace-static-x86_64: Process 402 attached [pid 400] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 399] <... mmap resumed>) = 0x7f620fc64000 [pid 397] <... futex resumed>) = 0 [pid 396] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 391] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] newfstatat(AT_FDCWD, "./3/ext4", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 399] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 397] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] <... futex resumed>) = 0 [pid 297] umount2("./3/ext4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 399] <... write resumed>) = 65536 [pid 297] openat(AT_FDCWD, "./3/ext4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 400] <... mount resumed>) = 0 [pid 399] munmap(0x7f620fc64000, 65536 [pid 397] <... futex resumed>) = 0 [pid 396] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... openat resumed>) = 4 [pid 297] newfstatat(4, "", [pid 399] <... munmap resumed>) = 0 [pid 397] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 396] <... futex resumed>) = 0 [pid 403] set_robust_list(0x7f62204659a0, 24 [pid 402] set_robust_list(0x7f62204659a0, 24 [pid 400] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 397] <... mmap resumed>) = 0x7f6220424000 [pid 396] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 403] <... set_robust_list resumed>) = 0 [pid 402] <... set_robust_list resumed>) = 0 [pid 400] <... futex resumed>) = 1 [pid 399] <... openat resumed>) = 8 [pid 397] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 396] <... mmap resumed>) = 0x7f6220424000 [pid 391] <... futex resumed>) = 0 [pid 403] rt_sigprocmask(SIG_SETMASK, [], [pid 402] rt_sigprocmask(SIG_SETMASK, [], [pid 400] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 399] ioctl(8, LOOP_SET_FD, 7 [pid 397] <... mprotect resumed>) = 0 [pid 396] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 391] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 402] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 399] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 397] rt_sigprocmask(SIG_BLOCK, ~[], [pid 396] <... mprotect resumed>) = 0 [pid 391] <... futex resumed>) = 0 [pid 403] memfd_create("syzkaller", 0 [pid 402] memfd_create("syzkaller", 0 [pid 400] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 399] ioctl(8, LOOP_CLR_FD [pid 397] <... rt_sigprocmask resumed>[], 8) = 0 [pid 396] rt_sigprocmask(SIG_BLOCK, ~[], [pid 391] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... memfd_create resumed>) = 3 [pid 402] <... memfd_create resumed>) = 3 [pid 400] <... open resumed>) = 3 [pid 399] <... ioctl resumed>) = 0 [pid 397] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 396] <... rt_sigprocmask resumed>[], 8) = 0 [pid 403] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 402] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 400] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 403] <... mmap resumed>) = 0x7f6218024000 [pid 402] <... mmap resumed>) = 0x7f6218024000 [pid 400] <... futex resumed>) = 1 [pid 397] <... clone3 resumed> => {parent_tid=[405]}, 88) = 405 [pid 391] <... futex resumed>) = 0 [pid 403] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 402] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 400] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 397] rt_sigprocmask(SIG_SETMASK, [], [pid 396] <... clone3 resumed> => {parent_tid=[406]}, 88) = 406 [pid 391] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 379] +++ exited with 0 +++ [pid 378] +++ exited with 0 +++ [pid 297] getdents64(4, [pid 403] <... write resumed>) = 262144 [pid 402] <... write resumed>) = 262144 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 399] ioctl(8, LOOP_SET_FD, 7 [pid 397] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 396] rt_sigprocmask(SIG_SETMASK, [], [pid 391] <... futex resumed>) = 0 [pid 403] munmap(0x7f6218024000, 262144 [pid 402] munmap(0x7f6218024000, 262144 [pid 400] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 399] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 397] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 391] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... munmap resumed>) = 0 [pid 402] <... munmap resumed>) = 0 [pid 400] <... socket resumed>) = 6 [pid 399] close(8 [pid 397] <... futex resumed>) = 0 [pid 396] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 402] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 400] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] <... close resumed>) = 0 [pid 397] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] <... futex resumed>) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=378, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 297] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 403] <... openat resumed>) = 4 [pid 402] <... openat resumed>) = 4 [pid 400] <... futex resumed>) = 1 [pid 399] close(7 [pid 396] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 391] <... futex resumed>) = 0 [ 23.873151][ T395] loop0: detected capacity change from 0 to 512 [ 23.877915][ T398] loop2: detected capacity change from 0 to 512 [ 23.890151][ T401] EXT4-fs warning (device loop0): kmmpd:170: kmmpd being stopped since MMP feature has been disabled. [ 23.891700][ T395] EXT4-fs (loop0): revision level too high, forcing read-only mode [pid 403] ioctl(4, LOOP_SET_FD, 3 [pid 402] ioctl(4, LOOP_SET_FD, 3 [pid 400] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 399] <... close resumed>) = 0 [pid 391] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] getdents64(4, [pid 403] <... ioctl resumed>) = 0 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 399] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 391] <... futex resumed>) = 0 ./strace-static-x86_64: Process 405 attached [pid 403] close(3 [pid 402] <... ioctl resumed>) = 0 [pid 400] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 3, 0 [pid 399] <... futex resumed>) = 0 [pid 391] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 405] set_robust_list(0x7f62204449a0, 24 [pid 400] <... mmap resumed>) = 0x20000000 [pid 399] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] close(4 [pid 405] <... set_robust_list resumed>) = 0 [pid 400] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 405] rt_sigprocmask(SIG_SETMASK, [], [pid 400] <... futex resumed>) = 1 [pid 391] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... close resumed>) = 0 [pid 405] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 403] <... close resumed>) = 0 [pid 402] close(3 [pid 400] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 391] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] mkdir("./file0", 0777 [pid 402] <... close resumed>) = 0 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 391] <... futex resumed>) = 0 [pid 403] <... mkdir resumed>) = 0 [pid 402] mkdir("./file0", 0777 [pid 400] memfd_create("syzkaller", 0 [pid 403] mount("/dev/loop4", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 402] <... mkdir resumed>) = 0 [pid 400] <... memfd_create resumed>) = 7 [pid 405] creat("./bus", 000 [pid 402] mount("/dev/loop5", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 400] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 397] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 396] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 299] <... openat resumed>) = 3 [pid 297] rmdir("./3/ext4"./strace-static-x86_64: Process 406 attached [pid 400] <... mmap resumed>) = 0x7f620fc64000 [pid 397] futex(0x7f62205316ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] futex(0x7f62205316ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] set_robust_list(0x7f62204449a0, 24 [pid 405] <... creat resumed>) = 3 [ 23.921310][ T403] loop4: detected capacity change from 0 to 512 [ 23.928395][ T402] loop5: detected capacity change from 0 to 512 [ 23.959656][ T395] EXT4-fs error (device loop0): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # [pid 400] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 397] <... futex resumed>) = 0 [pid 396] <... futex resumed>) = 0 [pid 299] newfstatat(3, "", [pid 297] <... rmdir resumed>) = 0 [pid 406] <... set_robust_list resumed>) = 0 [pid 405] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 400] <... write resumed>) = 65536 [pid 397] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 396] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(3, [pid 405] <... futex resumed>) = 0 [pid 299] getdents64(3, [pid 297] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 405] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 297] close(3 [pid 299] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... close resumed>) = 0 [pid 297] rmdir("./3") = 0 [pid 297] mkdir("./4", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 410 [pid 397] <... mmap resumed>) = 0x7f6218043000 [pid 299] <... umount2 resumed>) = 0 [pid 396] <... mmap resumed>) = 0x7f6218043000 [pid 397] mprotect(0x7f6218044000, 131072, PROT_READ|PROT_WRITE [pid 406] rt_sigprocmask(SIG_SETMASK, [], [pid 400] munmap(0x7f620fc64000, 65536 [pid 397] <... mprotect resumed>) = 0 [pid 396] mprotect(0x7f6218044000, 131072, PROT_READ|PROT_WRITE [pid 299] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] <... munmap resumed>) = 0 [pid 397] rt_sigprocmask(SIG_BLOCK, ~[], [pid 396] <... mprotect resumed>) = 0 [pid 400] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 397] <... rt_sigprocmask resumed>[], 8) = 0 [pid 396] rt_sigprocmask(SIG_BLOCK, ~[], [pid 400] <... openat resumed>) = 8 [pid 397] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6218063990, parent_tid=0x7f6218063990, exit_signal=0, stack=0x7f6218043000, stack_size=0x20300, tls=0x7f62180636c0} [pid 400] ioctl(8, LOOP_SET_FD, 7 [pid 396] <... rt_sigprocmask resumed>[], 8) = 0 [pid 406] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 400] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 396] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6218063990, parent_tid=0x7f6218063990, exit_signal=0, stack=0x7f6218043000, stack_size=0x20300, tls=0x7f62180636c0} [pid 395] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 406] creat("./bus", 000 [pid 400] ioctl(8, LOOP_CLR_FD [pid 397] <... clone3 resumed> => {parent_tid=[412]}, 88) = 412 [pid 400] <... ioctl resumed>) = 0 [pid 397] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 396] <... clone3 resumed> => {parent_tid=[413]}, 88) = 413 [pid 397] futex(0x7f62205316e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] rt_sigprocmask(SIG_SETMASK, [], [pid 397] <... futex resumed>) = 0 [pid 396] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 397] futex(0x7f62205316ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] futex(0x7f62205316e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] <... creat resumed>) = 3 [pid 396] <... futex resumed>) = 0 [pid 396] futex(0x7f62205316ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 395] ioctl(5, LOOP_CLR_FD [pid 299] newfstatat(AT_FDCWD, "./3/bus", [pid 395] <... ioctl resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 395] close(5 [pid 299] unlink("./3/bus" [pid 395] <... close resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 395] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 395] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 400] close(8) = 0 [pid 395] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 400] close(7 [pid 392] exit_group(0 [pid 299] unlink("./3/binderfs" [pid 406] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 400] <... close resumed>) = 0 [pid 399] <... futex resumed>) = ? [pid 395] <... futex resumed>) = ? [pid 392] <... exit_group resumed>) = ? [pid 299] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 413 attached ./strace-static-x86_64: Process 412 attached ./strace-static-x86_64: Process 410 attached [pid 406] <... futex resumed>) = 0 [pid 400] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 399] +++ exited with 0 +++ [pid 395] +++ exited with 0 +++ [pid 299] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 413] set_robust_list(0x7f62180639a0, 24 [pid 412] set_robust_list(0x7f62180639a0, 24 [pid 410] set_robust_list(0x555556cc76a0, 24 [pid 406] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 400] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 413] <... set_robust_list resumed>) = 0 [pid 412] <... set_robust_list resumed>) = 0 [pid 410] <... set_robust_list resumed>) = 0 [pid 400] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] newfstatat(AT_FDCWD, "./3/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 299] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(4, 0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./3/file0") = 0 [pid 299] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./3") = 0 [pid 299] mkdir("./4", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [ 23.976113][ T395] EXT4-fs (loop0): get orphan inode failed [ 23.976773][ T407] EXT4-fs warning (device loop2): kmmpd:170: kmmpd being stopped since MMP feature has been disabled. [ 23.982425][ T395] EXT4-fs (loop0): mount failed [ 23.993691][ T398] EXT4-fs (loop2): revision level too high, forcing read-only mode [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 415 ./strace-static-x86_64: Process 415 attached [pid 413] rt_sigprocmask(SIG_SETMASK, [], [pid 412] rt_sigprocmask(SIG_SETMASK, [], [pid 410] chdir("./4" [pid 415] set_robust_list(0x555556cc76a0, 24 [pid 413] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 412] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 410] <... chdir resumed>) = 0 [pid 402] <... mount resumed>) = 0 [pid 415] <... set_robust_list resumed>) = 0 [pid 413] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 412] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 410] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 415] chdir("./4" [pid 413] <... mount resumed>) = 0 [pid 412] <... mount resumed>) = 0 [pid 410] <... prctl resumed>) = 0 [pid 415] <... chdir resumed>) = 0 [pid 413] futex(0x7f62205316ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] futex(0x7f62205316ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] setpgid(0, 0 [pid 415] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 413] <... futex resumed>) = 1 [pid 412] <... futex resumed>) = 1 [pid 410] <... setpgid resumed>) = 0 [pid 397] <... futex resumed>) = 0 [pid 396] <... futex resumed>) = 0 [pid 415] <... prctl resumed>) = 0 [pid 413] futex(0x7f62205316e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 412] futex(0x7f62205316e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 410] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 397] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] setpgid(0, 0 [pid 410] <... openat resumed>) = 3 [pid 406] <... futex resumed>) = 0 [pid 397] <... futex resumed>) = 1 [pid 396] <... futex resumed>) = 1 [pid 415] <... setpgid resumed>) = 0 [pid 410] write(3, "1000", 4 [pid 406] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 397] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 410] <... write resumed>) = 4 [pid 406] <... open resumed>) = 5 [pid 415] <... openat resumed>) = 3 [pid 410] close(3 [pid 406] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] write(3, "1000", 4 [pid 410] <... close resumed>) = 0 [pid 406] <... futex resumed>) = 1 [pid 396] <... futex resumed>) = 0 [pid 415] <... write resumed>) = 4 [pid 410] symlink("/dev/binderfs", "./binderfs" [pid 406] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 396] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] close(3 [pid 410] <... symlink resumed>) = 0 [pid 406] <... socket resumed>) = 6 [pid 396] <... futex resumed>) = 0 [pid 415] <... close resumed>) = 0 [pid 410] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] symlink("/dev/binderfs", "./binderfs" [pid 410] <... futex resumed>) = 0 [pid 406] <... futex resumed>) = 0 [pid 396] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 415] <... symlink resumed>) = 0 [pid 410] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 406] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 396] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] <... rt_sigaction resumed>NULL, 8) = 0 [pid 406] <... mmap resumed>) = 0x20000000 [pid 396] <... futex resumed>) = 0 [pid 415] <... futex resumed>) = 0 [pid 410] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 406] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 396] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 410] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 406] <... futex resumed>) = 0 [pid 396] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 415] <... rt_sigaction resumed>NULL, 8) = 0 [pid 405] <... futex resumed>) = 0 [pid 402] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 392] +++ exited with 0 +++ [pid 405] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 405] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 405] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 402] <... openat resumed>) = 6 [pid 402] chdir("./file0") = 0 [pid 402] ioctl(4, LOOP_CLR_FD) = 0 [pid 402] close(4) = 0 [pid 402] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 402] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 410] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 410] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 410] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 410] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[418]}, 88) = 418 [pid 410] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 410] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 410] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 410] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 410] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[419]}, 88) = 419 [pid 410] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 410] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 410] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 396] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] <... futex resumed>) = 0 [pid 396] <... futex resumed>) = 1 [pid 406] memfd_create("syzkaller", 0) = 7 [pid 406] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f620fc43000 [pid 406] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 397] <... futex resumed>) = 0 [pid 406] <... write resumed>) = 65536 [pid 406] munmap(0x7f620fc43000, 65536) = 0 [pid 406] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 8 [pid 406] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 406] ioctl(8, LOOP_CLR_FD) = 0 [pid 397] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=392, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 415] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 397] <... futex resumed>) = 1 [ 24.015741][ T402] EXT4-fs (loop5): mounted filesystem without journal. Opts: nodiscard,barrier,nouid32,grpquota,,errors=continue. Quota mode: writeback. [ 24.023836][ T398] EXT4-fs error (device loop2): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # [ 24.033273][ T402] ext4 filesystem being mounted at /root/syzkaller.bzF58U/5/file0 supports timestamps until 2038 (0x7fffffff) [ 24.044399][ T398] EXT4-fs (loop2): get orphan inode failed [ 24.062273][ T403] EXT4-fs (loop4): mounted filesystem without journal. Opts: nodiscard,barrier,nouid32,grpquota,,errors=continue. Quota mode: writeback. [pid 415] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 397] futex(0x7f62205316cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 406] close(8) = 0 [pid 406] close(7 [pid 415] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 406] <... close resumed>) = 0 [pid 406] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 406] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 415] <... mmap resumed>) = 0x7f6220445000 [pid 415] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 415] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 415] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 415] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 296] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 415] <... clone3 resumed> => {parent_tid=[420]}, 88) = 420 [pid 296] newfstatat(3, "", [pid 415] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 415] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 415] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] getdents64(3, [pid 415] <... futex resumed>) = 0 [pid 415] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 415] <... futex resumed>) = 0 [pid 415] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 415] <... mmap resumed>) = 0x7f6220424000 [pid 415] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 296] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 420 attached ./strace-static-x86_64: Process 419 attached ./strace-static-x86_64: Process 418 attached [pid 415] <... mprotect resumed>) = 0 [pid 402] <... futex resumed>) = 0 [pid 296] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 420] set_robust_list(0x7f62204659a0, 24 [pid 415] rt_sigprocmask(SIG_BLOCK, ~[], [pid 402] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 419] set_robust_list(0x7f62204449a0, 24 [pid 418] set_robust_list(0x7f62204659a0, 24 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 420] <... set_robust_list resumed>) = 0 [pid 415] <... rt_sigprocmask resumed>[], 8) = 0 [pid 402] <... socket resumed>) = 4 [pid 296] newfstatat(AT_FDCWD, "./3/bus", [pid 420] rt_sigprocmask(SIG_SETMASK, [], [pid 418] <... set_robust_list resumed>) = 0 [pid 420] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 415] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 402] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... set_robust_list resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 420] memfd_create("syzkaller", 0 [pid 418] rt_sigprocmask(SIG_SETMASK, [], [pid 403] <... mount resumed>) = 0 [pid 419] rt_sigprocmask(SIG_SETMASK, [], [pid 402] <... futex resumed>) = 1 [pid 397] <... futex resumed>) = 0 [pid 418] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] unlink("./3/bus"./strace-static-x86_64: Process 421 attached [pid 420] <... memfd_create resumed>) = 3 [pid 419] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 415] <... clone3 resumed> => {parent_tid=[421]}, 88) = 421 [pid 403] openat(AT_FDCWD, 0x20000000, O_RDONLY|O_DIRECTORY [pid 402] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 397] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 418] memfd_create("syzkaller", 0 [pid 421] set_robust_list(0x7f62204449a0, 24 [pid 420] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 419] creat("./bus", 000 [pid 415] rt_sigprocmask(SIG_SETMASK, [], [pid 403] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 296] <... unlink resumed>) = 0 [pid 420] <... mmap resumed>) = 0x7f6218024000 [pid 402] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 397] <... futex resumed>) = 0 [pid 421] <... set_robust_list resumed>) = 0 [pid 419] <... creat resumed>) = 3 [pid 415] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 402] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 397] futex(0x7f62205316cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 420] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 415] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 421] rt_sigprocmask(SIG_SETMASK, [], [pid 402] <... mmap resumed>) = 0x20000000 [pid 421] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 421] creat("./bus", 000 [pid 415] <... futex resumed>) = 0 [pid 418] <... memfd_create resumed>) = 4 [pid 403] ioctl(4, LOOP_CLR_FD [pid 415] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 421] <... creat resumed>) = 4 [pid 403] <... ioctl resumed>) = 0 [pid 402] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 418] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 419] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 420] <... write resumed>) = 262144 [pid 403] close(4 [pid 402] <... futex resumed>) = 1 [pid 397] <... futex resumed>) = 0 [pid 418] <... mmap resumed>) = 0x7f6218024000 [pid 403] <... close resumed>) = 0 [pid 397] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] memfd_create("syzkaller", 0 [pid 403] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 397] <... futex resumed>) = 0 [pid 396] exit_group(0 [pid 406] <... futex resumed>) = ? [pid 396] <... exit_group resumed>) = ? [pid 421] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 420] munmap(0x7f6218024000, 262144 [pid 419] <... futex resumed>) = 1 [pid 418] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 413] <... futex resumed>) = ? [pid 410] <... futex resumed>) = 0 [pid 406] +++ exited with 0 +++ [pid 403] <... futex resumed>) = ? [pid 402] <... memfd_create resumed>) = 7 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 421] <... futex resumed>) = 1 [pid 420] <... munmap resumed>) = 0 [pid 419] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 415] <... futex resumed>) = 0 [pid 410] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 398] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 421] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 420] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 419] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 415] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] +++ exited with 0 +++ [pid 410] <... futex resumed>) = 0 [pid 421] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 420] <... openat resumed>) = 5 [pid 419] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 415] <... futex resumed>) = 0 [pid 410] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] +++ exited with 0 +++ [pid 402] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 396] +++ exited with 0 +++ [pid 296] newfstatat(AT_FDCWD, "./3/binderfs", [pid 421] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 420] ioctl(5, LOOP_SET_FD, 3 [pid 419] <... mount resumed>) = 0 [pid 415] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 421] <... mount resumed>) = 0 [pid 419] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 418] <... write resumed>) = 262144 [pid 402] <... mmap resumed>) = 0x7f620fc43000 [pid 398] ioctl(4, LOOP_CLR_FD [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 421] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = 1 [pid 418] munmap(0x7f6218024000, 262144 [pid 415] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 410] <... futex resumed>) = 0 [pid 421] <... futex resumed>) = 0 [pid 419] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 418] <... munmap resumed>) = 0 [pid 415] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 398] <... ioctl resumed>) = 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=396, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 296] unlink("./3/binderfs" [pid 421] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 419] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 418] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 415] <... futex resumed>) = 0 [pid 410] <... futex resumed>) = 0 [pid 419] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 418] <... openat resumed>) = 5 [pid 415] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 410] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 402] <... write resumed>) = 65536 [pid 398] close(4 [pid 300] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... unlink resumed>) = 0 [pid 419] <... open resumed>) = 6 [pid 418] ioctl(5, LOOP_SET_FD, 4 [pid 402] munmap(0x7f620fc43000, 65536 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 398] <... close resumed>) = 0 [pid 296] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 419] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 410] <... futex resumed>) = 0 [pid 419] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 410] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 410] <... futex resumed>) = 0 [pid 419] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 410] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 419] <... socket resumed>) = 7 [pid 419] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 410] <... futex resumed>) = 0 [pid 419] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 410] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 410] <... futex resumed>) = 0 [pid 419] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 410] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 419] <... mmap resumed>) = 0x20000000 [pid 402] <... munmap resumed>) = 0 [pid 398] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 419] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 398] <... futex resumed>) = 0 [pid 300] <... openat resumed>) = 3 [pid 296] newfstatat(AT_FDCWD, "./3/file0", [pid 419] <... futex resumed>) = 1 [pid 410] <... futex resumed>) = 0 [pid 402] <... openat resumed>) = 8 [pid 398] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] newfstatat(3, "", [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 419] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [ 24.078979][ T398] EXT4-fs (loop2): mount failed [ 24.088438][ T403] ext4 filesystem being mounted at /root/syzkaller.Zpv55J/5/file0 supports timestamps until 2038 (0x7fffffff) [ 24.111643][ T420] loop3: detected capacity change from 0 to 512 [ 24.121543][ T418] loop1: detected capacity change from 0 to 512 [pid 410] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] ioctl(8, LOOP_SET_FD, 7 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 419] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 410] <... futex resumed>) = 0 [pid 402] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 300] getdents64(3, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 420] <... ioctl resumed>) = 0 [pid 421] <... open resumed>) = 6 [pid 418] <... ioctl resumed>) = 0 [pid 402] ioctl(8, LOOP_CLR_FD [pid 391] exit_group(0 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 296] openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 421] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 420] close(3 [pid 421] <... futex resumed>) = 1 [pid 421] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 420] <... close resumed>) = 0 [pid 420] mkdir("./file0", 0777) = 0 [pid 402] <... ioctl resumed>) = 0 [pid 391] <... exit_group resumed>) = ? [pid 415] <... futex resumed>) = 0 [pid 400] <... futex resumed>) = ? [pid 398] <... futex resumed>) = ? [pid 415] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 400] +++ exited with 0 +++ [pid 296] <... openat resumed>) = 4 [pid 398] +++ exited with 0 +++ [pid 420] mount("/dev/loop3", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 421] <... futex resumed>) = 0 [pid 415] <... futex resumed>) = 1 [pid 418] close(4 [pid 421] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 418] <... close resumed>) = 0 [pid 421] <... socket resumed>) = 3 [pid 418] mkdir(0x20000000, 0777 [pid 415] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] newfstatat(4, "", [pid 421] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 418] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 415] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 421] <... futex resumed>) = 0 [pid 415] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 419] memfd_create("syzkaller", 0) = 4 [pid 419] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f620fc64000 [pid 421] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 419] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 418] mount("/dev/loop1", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 415] <... futex resumed>) = 0 [pid 300] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(4, [pid 421] <... mmap resumed>) = 0x20000000 [pid 415] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 402] ioctl(8, LOOP_SET_FD, 7 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 402] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 296] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 421] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] close(8 [pid 300] newfstatat(AT_FDCWD, "./5/bus", [pid 296] getdents64(4, [pid 421] <... futex resumed>) = 1 [pid 419] <... write resumed>) = 65536 [pid 418] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 415] <... futex resumed>) = 0 [pid 421] memfd_create("syzkaller", 0 [pid 419] munmap(0x7f620fc64000, 65536 [pid 418] ioctl(5, LOOP_CLR_FD [pid 415] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... close resumed>) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 421] <... memfd_create resumed>) = 7 [pid 418] <... ioctl resumed>) = 0 [pid 419] <... munmap resumed>) = 0 [pid 415] <... futex resumed>) = 0 [pid 402] close(7 [pid 300] unlink("./5/bus" [pid 296] close(4 [pid 421] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 419] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 418] close(5 [pid 402] <... close resumed>) = 0 [pid 300] <... unlink resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 421] <... mmap resumed>) = 0x7f620fc64000 [pid 418] <... close resumed>) = 0 [pid 402] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] rmdir("./3/file0" [pid 421] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 419] <... openat resumed>) = 5 [pid 418] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 402] <... futex resumed>) = 0 [pid 397] exit_group(0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... rmdir resumed>) = 0 [pid 421] <... write resumed>) = 65536 [pid 419] ioctl(5, LOOP_SET_FD, 4 [pid 418] <... futex resumed>) = 0 [pid 412] <... futex resumed>) = ? [pid 405] <... futex resumed>) = ? [pid 397] <... exit_group resumed>) = ? [pid 300] newfstatat(AT_FDCWD, "./5/binderfs", [pid 296] getdents64(3, [pid 421] munmap(0x7f620fc64000, 65536 [pid 419] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 418] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 412] +++ exited with 0 +++ [pid 405] +++ exited with 0 +++ [pid 402] +++ exited with 0 +++ [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 421] <... munmap resumed>) = 0 [pid 419] ioctl(5, LOOP_CLR_FD [pid 300] unlink("./5/binderfs" [pid 296] close(3 [pid 421] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 419] <... ioctl resumed>) = 0 [pid 397] +++ exited with 0 +++ [pid 300] <... unlink resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 421] <... openat resumed>) = 8 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=397, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 300] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] rmdir("./3" [pid 421] ioctl(8, LOOP_SET_FD, 7 [pid 296] <... rmdir resumed>) = 0 [pid 421] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 419] ioctl(5, LOOP_SET_FD, 4 [pid 296] mkdir("./4", 0777 [pid 421] ioctl(8, LOOP_CLR_FD [pid 419] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 301] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... mkdir resumed>) = 0 [pid 421] <... ioctl resumed>) = 0 [pid 419] close(5 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 419] <... close resumed>) = 0 [pid 301] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... openat resumed>) = 3 [pid 419] close(4 [pid 301] <... openat resumed>) = 3 [pid 296] ioctl(3, LOOP_CLR_FD [pid 419] <... close resumed>) = 0 [pid 301] newfstatat(3, "", [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 419] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 410] exit_group(0 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] close(3 [pid 419] <... futex resumed>) = ? [pid 418] <... futex resumed>) = ? [pid 410] <... exit_group resumed>) = ? [pid 301] getdents64(3, [pid 296] <... close resumed>) = 0 [pid 418] +++ exited with 0 +++ [pid 301] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 421] ioctl(8, LOOP_SET_FD, 7 [pid 301] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 422 attached [pid 421] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 419] +++ exited with 0 +++ [pid 410] +++ exited with 0 +++ [pid 391] +++ exited with 0 +++ [pid 301] <... umount2 resumed>) = 0 [pid 300] <... umount2 resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556cc7690) = 422 [pid 421] close(8 [pid 301] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=391, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 421] <... close resumed>) = 0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 421] close(7 [pid 301] newfstatat(AT_FDCWD, "./5/bus", [pid 300] newfstatat(AT_FDCWD, "./5/file0", [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=410, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 422] set_robust_list(0x555556cc76a0, 24 [pid 421] <... close resumed>) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 421] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] unlink("./5/bus" [pid 300] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 421] <... futex resumed>) = 0 [pid 301] <... unlink resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 421] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] openat(AT_FDCWD, "./5/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... openat resumed>) = 3 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... openat resumed>) = 4 [pid 298] newfstatat(3, "", [pid 301] newfstatat(AT_FDCWD, "./5/binderfs", [pid 300] newfstatat(4, "", [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(3, [pid 422] <... set_robust_list resumed>) = 0 [pid 301] unlink("./5/binderfs" [pid 300] getdents64(4, [pid 298] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 297] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 422] chdir("./4" [pid 301] <... unlink resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 298] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 301] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] getdents64(4, [pid 298] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 422] <... chdir resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 298] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] close(4 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... close resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./3/bus", [pid 300] rmdir("./5/file0" [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 422] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 300] <... rmdir resumed>) = 0 [pid 298] unlink("./3/bus" [pid 297] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 422] <... prctl resumed>) = 0 [pid 300] getdents64(3, [pid 298] <... unlink resumed>) = 0 [pid 422] setpgid(0, 0 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 298] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... openat resumed>) = 3 [pid 300] close(3 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 422] <... setpgid resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./3/binderfs", [pid 297] newfstatat(3, "", [pid 300] rmdir("./5" [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 422] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 300] <... rmdir resumed>) = 0 [pid 298] unlink("./3/binderfs" [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 300] mkdir("./6", 0777 [pid 298] <... unlink resumed>) = 0 [pid 422] <... openat resumed>) = 3 [pid 300] <... mkdir resumed>) = 0 [pid 298] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(3, [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 422] write(3, "1000", 4 [pid 300] <... openat resumed>) = 3 [pid 298] newfstatat(AT_FDCWD, "./3/file0", [pid 297] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 300] ioctl(3, LOOP_CLR_FD [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 422] <... write resumed>) = 4 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] umount2("./3/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] close(3 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 422] close(3 [pid 300] <... close resumed>) = 0 [pid 298] openat(AT_FDCWD, "./3/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... umount2 resumed>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... openat resumed>) = 4 [pid 297] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 422] <... close resumed>) = 0 [pid 298] newfstatat(4, "", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 422] symlink("/dev/binderfs", "./binderfs" [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 423 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] newfstatat(AT_FDCWD, "./4/bus", [pid 298] getdents64(4, [pid 422] <... symlink resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 422] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(4, [pid 297] unlink("./4/bus" [pid 422] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./3/file0" [pid 422] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 297] <... unlink resumed>) = 0 [pid 422] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 297] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 422] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 298] getdents64(3, [pid 422] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] close(3 [pid 422] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... close resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./4/binderfs", [pid 422] <... mmap resumed>) = 0x7f6220445000 [pid 298] rmdir("./3" [pid 422] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 298] <... rmdir resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 422] <... mprotect resumed>) = 0 [pid 298] mkdir("./4", 0777 [pid 297] unlink("./4/binderfs" [pid 422] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... mkdir resumed>) = 0 [pid 422] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 297] <... unlink resumed>) = 0 [pid 422] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 298] <... openat resumed>) = 3 [pid 420] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 297] getdents64(3, [pid 420] ioctl(5, LOOP_CLR_FD [pid 298] ioctl(3, LOOP_CLR_FD [pid 420] <... ioctl resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 422] <... clone3 resumed> => {parent_tid=[424]}, 88) = 424 [pid 420] close(5 [pid 298] close(3 [pid 297] close(3./strace-static-x86_64: Process 424 attached ./strace-static-x86_64: Process 423 attached [pid 422] rt_sigprocmask(SIG_SETMASK, [], [pid 420] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 422] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 420] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] rmdir("./4" [pid 422] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 420] <... futex resumed>) = 0 [pid 415] exit_group(0 [pid 421] <... futex resumed>) = ? [pid 415] <... exit_group resumed>) = ? [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 425 ./strace-static-x86_64: Process 425 attached [pid 422] <... futex resumed>) = 0 [pid 421] +++ exited with 0 +++ [pid 297] <... rmdir resumed>) = 0 [pid 422] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] mkdir("./5", 0777 [pid 422] <... futex resumed>) = 0 [pid 424] set_robust_list(0x7f62204659a0, 24) = 0 [pid 424] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 424] memfd_create("syzkaller", 0 [pid 422] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... mkdir resumed>) = 0 [pid 425] set_robust_list(0x555556cc76a0, 24 [pid 422] <... mmap resumed>) = 0x7f6220424000 [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 422] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 297] <... openat resumed>) = 3 [pid 422] <... mprotect resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 422] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 422] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 297] close(3) = 0 [pid 422] <... clone3 resumed> => {parent_tid=[426]}, 88) = 426 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 426 attached [pid 425] <... set_robust_list resumed>) = 0 [pid 424] <... memfd_create resumed>) = 3 [pid 424] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218024000 [pid 422] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 ./strace-static-x86_64: Process 427 attached [pid 426] set_robust_list(0x7f62204449a0, 24 [pid 425] chdir("./4" [pid 422] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... clone resumed>, child_tidptr=0x555556cc7690) = 427 [pid 427] set_robust_list(0x555556cc76a0, 24 [pid 426] <... set_robust_list resumed>) = 0 [pid 425] <... chdir resumed>) = 0 [pid 422] <... futex resumed>) = 0 [pid 424] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 422] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 427] <... set_robust_list resumed>) = 0 [pid 426] rt_sigprocmask(SIG_SETMASK, [], [pid 423] set_robust_list(0x555556cc76a0, 24) = 0 [pid 426] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 425] <... prctl resumed>) = 0 [pid 426] creat("./bus", 000 [pid 425] setpgid(0, 0) = 0 [pid 423] chdir("./6" [pid 425] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 423] <... chdir resumed>) = 0 [pid 423] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 423] setpgid(0, 0) = 0 [pid 423] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 425] <... openat resumed>) = 3 [pid 426] <... creat resumed>) = 4 [pid 426] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] write(3, "1000", 4 [pid 423] <... openat resumed>) = 3 [pid 426] <... futex resumed>) = 1 [pid 425] <... write resumed>) = 4 [pid 422] <... futex resumed>) = 0 [pid 422] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 426] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 425] close(3 [pid 423] write(3, "1000", 4) = 4 [pid 423] close(3) = 0 [pid 423] symlink("/dev/binderfs", "./binderfs" [pid 422] <... futex resumed>) = 0 [pid 425] <... close resumed>) = 0 [pid 425] symlink("/dev/binderfs", "./binderfs" [pid 423] <... symlink resumed>) = 0 [pid 422] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 423] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 423] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 423] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 423] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 427] chdir("./5" [pid 426] <... mount resumed>) = 0 [pid 425] <... symlink resumed>) = 0 [pid 423] <... mmap resumed>) = 0x7f6220445000 [pid 423] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 427] <... chdir resumed>) = 0 [pid 426] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 424] <... write resumed>) = 262144 [pid 423] <... mprotect resumed>) = 0 [pid 423] rt_sigprocmask(SIG_BLOCK, ~[], [pid 425] <... futex resumed>) = 0 [pid 423] <... rt_sigprocmask resumed>[], 8) = 0 [pid 422] <... futex resumed>) = 0 [pid 423] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 425] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 422] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 423] <... clone3 resumed> => {parent_tid=[428]}, 88) = 428 [pid 422] <... futex resumed>) = 0 [pid 425] <... rt_sigaction resumed>NULL, 8) = 0 [pid 422] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 423] rt_sigprocmask(SIG_SETMASK, [], [pid 425] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 423] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 423] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 423] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 423] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 423] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 423] rt_sigprocmask(SIG_BLOCK, ~[], [pid 425] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 427] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 426] <... futex resumed>) = 1 [pid 424] munmap(0x7f6218024000, 262144 [pid 423] <... rt_sigprocmask resumed>[], 8) = 0 [pid 427] <... prctl resumed>) = 0 [pid 426] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 425] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 424] <... munmap resumed>) = 0 [pid 423] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 425] <... mmap resumed>) = 0x7f6220445000 [pid 423] <... clone3 resumed> => {parent_tid=[429]}, 88) = 429 [pid 425] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 423] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 423] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 423] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 428 attached [pid 428] set_robust_list(0x7f62204659a0, 24) = 0 [pid 428] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 428] memfd_create("syzkaller", 0) = 3 [pid 428] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218024000 [pid 425] rt_sigprocmask(SIG_BLOCK, ~[], [pid 426] <... open resumed>) = 5 [pid 425] <... rt_sigprocmask resumed>[], 8) = 0 [pid 426] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0}./strace-static-x86_64: Process 430 attached [pid 428] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 427] setpgid(0, 0 [pid 426] <... futex resumed>) = 1 [pid 424] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 422] <... futex resumed>) = 0 [pid 426] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 425] <... clone3 resumed> => {parent_tid=[430]}, 88) = 430 [pid 422] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... setpgid resumed>) = 0 [pid 426] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 425] rt_sigprocmask(SIG_SETMASK, [], [pid 422] <... futex resumed>) = 0 [pid 426] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 425] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 422] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 426] <... socket resumed>) = 6 [pid 425] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 426] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] <... futex resumed>) = 0 ./strace-static-x86_64: Process 429 attached [pid 425] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 426] <... futex resumed>) = 1 [pid 422] <... futex resumed>) = 0 [pid 425] <... futex resumed>) = 0 [pid 422] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 426] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 425] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 422] <... futex resumed>) = 0 [pid 425] <... mmap resumed>) = 0x7f6220424000 [pid 422] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 430] set_robust_list(0x7f62204659a0, 24 [pid 429] set_robust_list(0x7f62204449a0, 24 [pid 428] <... write resumed>) = 262144 [pid 427] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 426] <... mmap resumed>) = 0x20000000 [pid 425] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 424] <... openat resumed>) = 7 [pid 425] <... mprotect resumed>) = 0 [pid 426] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] rt_sigprocmask(SIG_BLOCK, ~[], [pid 422] <... futex resumed>) = 0 [pid 426] <... futex resumed>) = 1 [pid 425] <... rt_sigprocmask resumed>[], 8) = 0 [pid 422] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 426] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 425] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 422] <... futex resumed>) = 0 [pid 429] <... set_robust_list resumed>) = 0 [pid 429] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 429] creat("./bus", 000) = 4 [pid 425] <... clone3 resumed> => {parent_tid=[431]}, 88) = 431 [pid 427] <... openat resumed>) = 3 [pid 429] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 423] <... futex resumed>) = 0 [pid 425] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 423] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 429] <... futex resumed>) = 1 [pid 425] <... futex resumed>) = 0 [pid 423] <... futex resumed>) = 0 [pid 429] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 423] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 425] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 429] <... mount resumed>) = 0 [pid 429] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] write(3, "1000", 4 [pid 430] <... set_robust_list resumed>) = 0 [pid 429] <... futex resumed>) = 1 [pid 423] <... futex resumed>) = 0 [pid 427] <... write resumed>) = 4 [pid 429] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 428] munmap(0x7f6218024000, 262144 [pid 423] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] rt_sigprocmask(SIG_SETMASK, [], [ 24.130008][ T419] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 26 prio class 0 [ 24.159825][ T420] EXT4-fs warning (device loop3): read_mmp_block:115: Error -74 while reading MMP block 12 [pid 429] <... open resumed>) = 5 [pid 428] <... munmap resumed>) = 0 [pid 427] close(3 [pid 424] +++ killed by SIGBUS +++ [pid 423] <... futex resumed>) = 0 [pid 430] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 429] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 423] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 420] +++ exited with 0 +++ [pid 415] +++ exited with 0 +++ [pid 301] <... umount2 resumed>) = 0 [pid 429] <... futex resumed>) = 0 [pid 423] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=415, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 429] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 423] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 431 attached [pid 429] <... socket resumed>) = 6 [pid 423] <... futex resumed>) = 0 [pid 301] newfstatat(AT_FDCWD, "./5/file0", [pid 431] set_robust_list(0x7f62204449a0, 24 [pid 429] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 423] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 431] <... set_robust_list resumed>) = 0 [pid 429] <... futex resumed>) = 0 [pid 423] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 431] rt_sigprocmask(SIG_SETMASK, [], [pid 429] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 423] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 431] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 429] <... mmap resumed>) = 0x20000000 [pid 423] <... futex resumed>) = 0 [pid 301] openat(AT_FDCWD, "./5/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 431] creat("./bus", 000 [pid 429] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 426] +++ killed by SIGBUS +++ [pid 423] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 422] +++ killed by SIGBUS +++ [pid 301] <... openat resumed>) = 4 [pid 299] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 431] <... creat resumed>) = 3 [pid 429] <... futex resumed>) = 0 [pid 427] <... close resumed>) = 0 [pid 423] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] newfstatat(4, "", [pid 431] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] memfd_create("syzkaller", 0 [pid 429] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 428] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 427] symlink("/dev/binderfs", "./binderfs" [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=422, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 430] <... memfd_create resumed>) = 4 [pid 428] <... openat resumed>) = 7 [pid 427] <... symlink resumed>) = 0 [pid 301] getdents64(4, [pid 299] newfstatat(3, "", [pid 430] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 428] ioctl(7, LOOP_SET_FD, 3 [pid 427] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 431] <... futex resumed>) = 1 [pid 430] <... mmap resumed>) = 0x7f6218024000 [pid 429] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 428] <... ioctl resumed>) = 0 [pid 427] <... futex resumed>) = 0 [pid 425] <... futex resumed>) = 0 [pid 423] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] getdents64(4, [pid 299] getdents64(3, [pid 296] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 430] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 427] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 301] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 299] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 431] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 429] memfd_create("syzkaller", 0 [pid 427] <... rt_sigaction resumed>NULL, 8) = 0 [pid 425] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 423] <... futex resumed>) = 0 [pid 301] close(4 [pid 299] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 431] <... mount resumed>) = 0 [pid 430] <... write resumed>) = 262144 [pid 429] <... memfd_create resumed>) = 8 [pid 427] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 425] <... futex resumed>) = 0 [pid 301] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 431] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] munmap(0x7f6218024000, 262144 [pid 429] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 427] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 425] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] rmdir("./5/file0" [pid 299] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] newfstatat(3, "", [pid 431] <... futex resumed>) = 0 [pid 430] <... munmap resumed>) = 0 [pid 429] <... mmap resumed>) = 0x7f620fc64000 [pid 427] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 425] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] <... rmdir resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 431] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 430] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 429] write(8, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 427] <... mmap resumed>) = 0x7f6220445000 [pid 425] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] getdents64(3, [pid 299] newfstatat(AT_FDCWD, "./4/bus", [pid 296] getdents64(3, [pid 431] <... open resumed>) = 5 [pid 430] <... openat resumed>) = 6 [pid 429] <... write resumed>) = 65536 [pid 427] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 425] <... futex resumed>) = 0 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 431] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] ioctl(6, LOOP_SET_FD, 4 [pid 429] munmap(0x7f620fc64000, 65536 [pid 427] <... mprotect resumed>) = 0 [pid 425] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] close(3 [pid 299] unlink("./4/bus" [pid 296] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 431] <... futex resumed>) = 0 [pid 429] <... munmap resumed>) = 0 [pid 427] rt_sigprocmask(SIG_BLOCK, ~[], [pid 425] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] <... close resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 427] <... rt_sigprocmask resumed>[], 8) = 0 [pid 301] rmdir("./5" [pid 299] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 427] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 301] <... rmdir resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 301] mkdir("./6", 0777 [pid 299] newfstatat(AT_FDCWD, "./4/binderfs", [pid 427] <... clone3 resumed> => {parent_tid=[432]}, 88) = 432 [pid 301] <... mkdir resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 427] rt_sigprocmask(SIG_SETMASK, [], [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 299] unlink("./4/binderfs" [pid 427] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] <... openat resumed>) = 3 [pid 299] <... unlink resumed>) = 0 [pid 427] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] ioctl(3, LOOP_CLR_FD [pid 299] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 427] <... futex resumed>) = 0 [pid 301] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 427] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] close(3 [pid 299] newfstatat(AT_FDCWD, "./4/file0", [pid 427] <... futex resumed>) = 0 [pid 301] <... close resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 431] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 429] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 427] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 425] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] umount2("./4/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 431] <... socket resumed>) = 7 [pid 429] <... openat resumed>) = 9 [pid 427] <... mmap resumed>) = 0x7f6220424000 [pid 425] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 431] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 429] ioctl(9, LOOP_SET_FD, 8 [pid 427] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 425] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... clone resumed>, child_tidptr=0x555556cc7690) = 433 [pid 299] openat(AT_FDCWD, "./4/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 431] <... futex resumed>) = 0 [pid 429] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 427] <... mprotect resumed>) = 0 [pid 425] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] <... openat resumed>) = 4 [pid 296] newfstatat(AT_FDCWD, "./4/bus", [pid 431] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 429] ioctl(9, LOOP_CLR_FD [pid 428] close(3 [pid 427] rt_sigprocmask(SIG_BLOCK, ~[], [pid 425] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(4, "", [pid 431] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 429] <... ioctl resumed>) = 0 [pid 428] <... close resumed>) = 0 [pid 427] <... rt_sigprocmask resumed>[], 8) = 0 [pid 425] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 432 attached [pid 431] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 428] mkdir(0x20000000, 0777 [pid 427] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 425] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] getdents64(4, [pid 431] <... mmap resumed>) = 0x20000000 [pid 428] <... mkdir resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 296] unlink("./4/bus"./strace-static-x86_64: Process 433 attached [pid 431] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 428] mount("/dev/loop4", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 427] <... clone3 resumed> => {parent_tid=[434]}, 88) = 434 [pid 299] getdents64(4, [pid 433] set_robust_list(0x555556cc76a0, 24 [pid 431] <... futex resumed>) = 1 [pid 428] <... mount resumed>) = -1 ENODEV (No such device) [pid 427] rt_sigprocmask(SIG_SETMASK, [], [pid 425] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 296] <... unlink resumed>) = 0 [pid 433] <... set_robust_list resumed>) = 0 [pid 431] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 428] ioctl(7, LOOP_CLR_FD [pid 427] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 425] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(4 [pid 296] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 433] chdir("./6" [pid 431] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 429] ioctl(9, LOOP_SET_FD, 8 [pid 428] <... ioctl resumed>) = 0 [pid 427] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 433] <... chdir resumed>) = 0 [pid 432] set_robust_list(0x7f62204659a0, 24 [pid 431] memfd_create("syzkaller", 0 [pid 429] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 428] close(7 [pid 427] <... futex resumed>) = 0 [pid 299] rmdir("./4/file0" [pid 296] newfstatat(AT_FDCWD, "./4/binderfs", ./strace-static-x86_64: Process 434 attached [pid 433] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 432] <... set_robust_list resumed>) = 0 [pid 431] <... memfd_create resumed>) = 8 [pid 430] <... ioctl resumed>) = 0 [pid 429] close(9 [pid 428] <... close resumed>) = 0 [pid 427] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 434] set_robust_list(0x7f62204449a0, 24 [pid 433] <... prctl resumed>) = 0 [pid 432] rt_sigprocmask(SIG_SETMASK, [], [pid 431] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 430] close(4 [pid 429] <... close resumed>) = 0 [pid 428] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... rmdir resumed>) = 0 [pid 296] unlink("./4/binderfs" [pid 434] <... set_robust_list resumed>) = 0 [pid 433] setpgid(0, 0 [pid 432] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 431] <... mmap resumed>) = 0x7f620fc64000 [pid 430] <... close resumed>) = 0 [pid 429] close(8 [pid 428] <... futex resumed>) = 0 [pid 299] getdents64(3, [pid 296] <... unlink resumed>) = 0 [pid 434] rt_sigprocmask(SIG_SETMASK, [], [pid 433] <... setpgid resumed>) = 0 [pid 432] memfd_create("syzkaller", 0 [pid 431] write(8, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 430] mkdir(0x20000000, 0777 [pid 429] <... close resumed>) = 0 [pid 428] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 296] getdents64(3, [pid 434] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 433] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 432] <... memfd_create resumed>) = 3 [pid 431] <... write resumed>) = 65536 [pid 430] <... mkdir resumed>) = 0 [pid 429] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 423] exit_group(0 [pid 299] close(3 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 434] creat("./bus", 000 [pid 432] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 431] munmap(0x7f620fc64000, 65536 [pid 430] mount("/dev/loop2", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 429] <... futex resumed>) = ? [pid 428] <... futex resumed>) = ? [pid 423] <... exit_group resumed>) = ? [pid 296] close(3 [pid 434] <... creat resumed>) = 4 [pid 433] <... openat resumed>) = 3 [pid 432] <... mmap resumed>) = 0x7f6218024000 [pid 431] <... munmap resumed>) = 0 [pid 430] <... mount resumed>) = -1 ENODEV (No such device) [pid 429] +++ exited with 0 +++ [pid 428] +++ exited with 0 +++ [pid 423] +++ exited with 0 +++ [pid 299] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 434] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] write(3, "1000", 4 [pid 432] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 431] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 430] ioctl(6, LOOP_CLR_FD [pid 299] rmdir("./4" [pid 296] rmdir("./4" [pid 434] <... futex resumed>) = 1 [pid 433] <... write resumed>) = 4 [pid 432] <... write resumed>) = 262144 [pid 431] <... openat resumed>) = 4 [pid 430] <... ioctl resumed>) = 0 [pid 427] <... futex resumed>) = 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=423, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 299] <... rmdir resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 434] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 433] close(3 [pid 432] munmap(0x7f6218024000, 262144 [pid 431] ioctl(4, LOOP_SET_FD, 8 [pid 430] close(6 [pid 427] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 299] mkdir("./5", 0777 [pid 296] mkdir("./5", 0777 [pid 434] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 433] <... close resumed>) = 0 [pid 432] <... munmap resumed>) = 0 [pid 431] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 430] <... close resumed>) = 0 [pid 427] <... futex resumed>) = 0 [pid 300] <... restart_syscall resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 434] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 433] symlink("/dev/binderfs", "./binderfs" [pid 432] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 431] ioctl(4, LOOP_CLR_FD [pid 430] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 434] <... mount resumed>) = 0 [pid 433] <... symlink resumed>) = 0 [pid 432] <... openat resumed>) = 5 [pid 431] <... ioctl resumed>) = 0 [pid 430] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 434] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [ 24.220664][ T428] loop4: detected capacity change from 0 to 512 [ 24.236916][ T430] loop2: detected capacity change from 0 to 512 [pid 432] ioctl(5, LOOP_SET_FD, 3 [pid 430] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] ioctl(3, LOOP_CLR_FD [pid 296] ioctl(3, LOOP_CLR_FD [pid 434] <... futex resumed>) = 1 [pid 433] <... futex resumed>) = 0 [pid 427] <... futex resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 434] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 433] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 432] <... ioctl resumed>) = 0 [pid 427] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] close(3 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 434] <... open resumed>) = 6 [pid 433] <... rt_sigaction resumed>NULL, 8) = 0 [pid 432] close(3 [pid 427] <... futex resumed>) = 0 [pid 300] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... close resumed>) = 0 [pid 296] close(3 [pid 434] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 432] <... close resumed>) = 0 [pid 431] ioctl(4, LOOP_SET_FD, 8 [pid 427] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... openat resumed>) = 3 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... close resumed>) = 0 [pid 434] <... futex resumed>) = 0 [pid 433] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 432] mkdir("./file0", 0777 [pid 431] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 427] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] newfstatat(3, "", [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 434] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 433] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 432] <... mkdir resumed>) = 0 [pid 431] close(4 [pid 427] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 434] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 433] <... mmap resumed>) = 0x7f6220445000 [pid 432] mount("/dev/loop1", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 431] <... close resumed>) = 0 [pid 427] <... futex resumed>) = 0 [pid 300] getdents64(3, [pid 299] <... clone resumed>, child_tidptr=0x555556cc7690) = 435 [pid 296] <... clone resumed>, child_tidptr=0x555556cc7690) = 436 [pid 434] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 433] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 431] close(8 [pid 427] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 128 [pid 434] <... socket resumed>) = 3 [pid 433] <... mprotect resumed>) = 0 [pid 431] <... close resumed>) = 0 [pid 300] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 434] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] rt_sigprocmask(SIG_BLOCK, ~[], [pid 431] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = 0 [pid 434] <... futex resumed>) = 1 [pid 431] <... futex resumed>) = 0 [pid 425] exit_group(0 [pid 300] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 436 attached ./strace-static-x86_64: Process 435 attached [pid 434] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 433] <... rt_sigprocmask resumed>[], 8) = 0 [pid 430] <... futex resumed>) = ? [pid 427] <... futex resumed>) = 0 [pid 425] <... exit_group resumed>) = ? [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 433] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 431] +++ exited with 0 +++ [pid 430] +++ exited with 0 +++ [pid 427] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] newfstatat(AT_FDCWD, "./6/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 434] <... futex resumed>) = 0 [pid 433] <... clone3 resumed> => {parent_tid=[439]}, 88) = 439 [pid 427] <... futex resumed>) = 1 [pid 300] unlink("./6/bus" [pid 434] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 433] rt_sigprocmask(SIG_SETMASK, [], [pid 427] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... unlink resumed>) = 0 [pid 434] <... mmap resumed>) = 0x20000000 [pid 433] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 434] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 434] <... futex resumed>) = 1 [pid 427] <... futex resumed>) = 0 [pid 300] newfstatat(AT_FDCWD, "./6/binderfs", [pid 434] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 433] <... futex resumed>) = 0 [pid 427] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 434] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 433] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 427] <... futex resumed>) = 0 [pid 300] unlink("./6/binderfs" [pid 435] set_robust_list(0x555556cc76a0, 24 [pid 434] memfd_create("syzkaller", 0 [pid 433] <... futex resumed>) = 0 [pid 300] <... unlink resumed>) = 0 [pid 434] <... memfd_create resumed>) = 7 [pid 433] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] umount2("./6/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 434] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 433] <... mmap resumed>) = 0x7f6220424000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 434] <... mmap resumed>) = 0x7f620fc64000 [pid 300] newfstatat(AT_FDCWD, "./6/ext4", [pid 435] <... set_robust_list resumed>) = 0 [pid 434] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 433] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 434] <... write resumed>) = 65536 [pid 433] <... mprotect resumed>) = 0 [pid 300] umount2("./6/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 434] munmap(0x7f620fc64000, 65536 [pid 433] rt_sigprocmask(SIG_BLOCK, ~[], [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 434] <... munmap resumed>) = 0 [pid 433] <... rt_sigprocmask resumed>[], 8) = 0 [pid 300] openat(AT_FDCWD, "./6/ext4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 434] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 433] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 300] <... openat resumed>) = 4 [pid 434] <... openat resumed>) = 8 [pid 300] newfstatat(4, "", [pid 434] ioctl(8, LOOP_SET_FD, 7 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 434] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 433] <... clone3 resumed> => {parent_tid=[440]}, 88) = 440 [pid 300] getdents64(4, [pid 434] ioctl(8, LOOP_CLR_FD [pid 433] rt_sigprocmask(SIG_SETMASK, [], [pid 300] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 434] <... ioctl resumed>) = 0 [pid 433] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] getdents64(4, 0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 433] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] close(4 [pid 435] chdir("./5" [pid 433] <... futex resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 433] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] rmdir("./6/ext4" [pid 436] set_robust_list(0x555556cc76a0, 24 [pid 435] <... chdir resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 435] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 300] getdents64(3, [pid 435] <... prctl resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 435] setpgid(0, 0 [pid 300] close(3) = 0 [pid 300] rmdir("./6" [pid 436] <... set_robust_list resumed>) = 0 [pid 435] <... setpgid resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 434] ioctl(8, LOOP_SET_FD, 7 [pid 300] mkdir("./7", 0777./strace-static-x86_64: Process 440 attached ./strace-static-x86_64: Process 439 attached [pid 436] chdir("./5" [pid 435] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 434] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 300] <... mkdir resumed>) = 0 [pid 440] set_robust_list(0x7f62204449a0, 24 [pid 439] set_robust_list(0x7f62204659a0, 24 [pid 436] <... chdir resumed>) = 0 [pid 435] <... openat resumed>) = 3 [pid 440] <... set_robust_list resumed>) = 0 [pid 439] <... set_robust_list resumed>) = 0 [pid 436] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 435] write(3, "1000", 4 [pid 440] rt_sigprocmask(SIG_SETMASK, [], [pid 439] rt_sigprocmask(SIG_SETMASK, [], [pid 436] <... prctl resumed>) = 0 [pid 435] <... write resumed>) = 4 [pid 440] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 439] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 436] setpgid(0, 0 [pid 435] close(3 [pid 440] creat("./bus", 000 [pid 439] memfd_create("syzkaller", 0 [pid 436] <... setpgid resumed>) = 0 [pid 435] <... close resumed>) = 0 [pid 440] <... creat resumed>) = 4 [pid 439] <... memfd_create resumed>) = 3 [pid 436] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 435] symlink("/dev/binderfs", "./binderfs" [pid 440] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 436] <... openat resumed>) = 3 [pid 435] <... symlink resumed>) = 0 [pid 440] <... futex resumed>) = 1 [pid 439] <... mmap resumed>) = 0x7f6218024000 [pid 436] write(3, "1000", 4 [pid 435] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] <... futex resumed>) = 0 [pid 440] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 439] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 436] <... write resumed>) = 4 [pid 435] <... futex resumed>) = 0 [pid 434] close(8 [pid 433] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 440] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 439] <... write resumed>) = 262144 [pid 436] close(3 [pid 435] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 433] <... futex resumed>) = 0 [pid 440] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 439] munmap(0x7f6218024000, 262144 [pid 436] <... close resumed>) = 0 [pid 435] <... rt_sigaction resumed>NULL, 8) = 0 [pid 433] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 440] <... mount resumed>) = 0 [pid 439] <... munmap resumed>) = 0 [pid 436] symlink("/dev/binderfs", "./binderfs" [pid 435] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 440] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 436] <... symlink resumed>) = 0 [pid 435] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 440] <... futex resumed>) = 1 [pid 439] <... openat resumed>) = 5 [pid 436] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 433] <... futex resumed>) = 0 [pid 440] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 439] ioctl(5, LOOP_SET_FD, 3 [pid 436] <... futex resumed>) = 0 [pid 435] <... mmap resumed>) = 0x7f6220445000 [pid 433] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 436] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 434] <... close resumed>) = 0 [pid 300] <... openat resumed>) = 3 [pid 434] close(7 [pid 300] ioctl(3, LOOP_CLR_FD [pid 434] <... close resumed>) = 0 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 434] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] close(3 [pid 434] <... futex resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 434] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 441 ./strace-static-x86_64: Process 441 attached [pid 441] set_robust_list(0x555556cc76a0, 24) = 0 [pid 441] chdir("./7") = 0 [pid 441] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 441] setpgid(0, 0) = 0 [pid 441] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 441] write(3, "1000", 4) = 4 [pid 441] close(3) = 0 [pid 441] symlink("/dev/binderfs", "./binderfs") = 0 [pid 441] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 441] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 441] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 441] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 441] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 441] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[442]}, 88) = 442 [pid 441] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 441] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 441] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 441] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 441] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[443]}, 88) = 443 [pid 441] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 441] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 443 attached [pid 443] set_robust_list(0x7f62204449a0, 24) = 0 [pid 443] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 443] creat("./bus", 000) = 3 [pid 435] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 433] <... futex resumed>) = 0 [pid 433] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 440] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 436] <... rt_sigaction resumed>NULL, 8) = 0 [pid 435] <... mprotect resumed>) = 0 [pid 436] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 435] rt_sigprocmask(SIG_BLOCK, ~[], [pid 436] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 435] <... rt_sigprocmask resumed>[], 8) = 0 [pid 436] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 435] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 436] <... mmap resumed>) = 0x7f6220445000 [pid 436] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 435] <... clone3 resumed> => {parent_tid=[444]}, 88) = 444 [pid 436] <... mprotect resumed>) = 0 [pid 435] rt_sigprocmask(SIG_SETMASK, [], [pid 436] rt_sigprocmask(SIG_BLOCK, ~[], [pid 435] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 436] <... rt_sigprocmask resumed>[], 8) = 0 [pid 435] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 436] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 435] <... futex resumed>) = 0 [pid 443] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 425] +++ exited with 0 +++ [pid 441] <... futex resumed>) = 0 [pid 441] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 443] <... futex resumed>) = 1 [pid 443] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 443] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 441] <... futex resumed>) = 0 [pid 441] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 443] <... futex resumed>) = 1 [pid 443] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 443] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 441] <... futex resumed>) = 0 [pid 441] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 443] <... futex resumed>) = 1 [pid 443] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE) = 5 [pid 443] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 441] <... futex resumed>) = 0 [pid 441] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 443] <... futex resumed>) = 1 [pid 443] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0) = 0x20000000 [pid 443] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 441] <... futex resumed>) = 0 [pid 441] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 443] <... futex resumed>) = 1 [pid 443] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- ./strace-static-x86_64: Process 442 attached [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=425, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 435] <... futex resumed>) = 0 [pid 436] <... clone3 resumed> => {parent_tid=[445]}, 88) = 445 [pid 298] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 436] rt_sigprocmask(SIG_SETMASK, [], [pid 435] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 435] <... mmap resumed>) = 0x7f6220424000 [pid 436] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 436] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 298] newfstatat(3, "", [pid 436] <... futex resumed>) = 0 [pid 435] <... mprotect resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 436] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] getdents64(3, [pid 435] <... rt_sigprocmask resumed>[], 8) = 0 [pid 436] <... futex resumed>) = 0 [pid 436] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 435] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 298] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 128 [pid 298] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 436] <... mmap resumed>) = 0x7f6220424000 [pid 435] <... clone3 resumed> => {parent_tid=[446]}, 88) = 446 [pid 436] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 435] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... umount2 resumed>) = 0 [pid 436] <... mprotect resumed>) = 0 [pid 435] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 436] rt_sigprocmask(SIG_BLOCK, ~[], [pid 435] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 436] <... rt_sigprocmask resumed>[], 8) = 0 [pid 435] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./4/bus", [pid 436] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 435] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 442] +++ killed by SIGBUS +++ [pid 298] unlink("./4/bus" [pid 436] <... clone3 resumed> => {parent_tid=[447]}, 88) = 447 [pid 298] <... unlink resumed>) = 0 [pid 436] rt_sigprocmask(SIG_SETMASK, [], [pid 298] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 436] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 436] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(AT_FDCWD, "./4/binderfs", [pid 436] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 436] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] unlink("./4/binderfs" [pid 443] +++ killed by SIGBUS +++ [pid 441] +++ killed by SIGBUS +++ [pid 298] <... unlink resumed>) = 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=441, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 298] umount2("./4/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... restart_syscall resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./4/ext4", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] umount2("./4/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./4/ext4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] <... openat resumed>) = 4 [pid 300] newfstatat(3, "", [pid 298] newfstatat(4, "", [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 300] getdents64(3, [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 300] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(4, [pid 300] <... umount2 resumed>) = 0 [pid 300] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 300] newfstatat(AT_FDCWD, "./7/bus", [pid 298] getdents64(4, ./strace-static-x86_64: Process 445 attached [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 445] set_robust_list(0x7f62204659a0, 24 [pid 300] unlink("./7/bus" [pid 298] close(4 [pid 445] <... set_robust_list resumed>) = 0 [pid 300] <... unlink resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 445] rt_sigprocmask(SIG_SETMASK, [], [pid 300] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] rmdir("./4/ext4" [pid 445] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 447 attached ./strace-static-x86_64: Process 446 attached [pid 445] memfd_create("syzkaller", 0 [pid 300] newfstatat(AT_FDCWD, "./7/binderfs", [pid 447] set_robust_list(0x7f62204449a0, 24 [pid 446] set_robust_list(0x7f62204449a0, 24 [pid 445] <... memfd_create resumed>) = 3 [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 444 attached [pid 447] <... set_robust_list resumed>) = 0 [pid 446] <... set_robust_list resumed>) = 0 [pid 445] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 300] unlink("./7/binderfs" [pid 298] getdents64(3, [pid 447] rt_sigprocmask(SIG_SETMASK, [], [pid 446] rt_sigprocmask(SIG_SETMASK, [], [pid 445] <... mmap resumed>) = 0x7f6218024000 [pid 444] set_robust_list(0x7f62204659a0, 24 [pid 300] <... unlink resumed>) = 0 [pid 447] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 446] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 445] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 444] <... set_robust_list resumed>) = 0 [pid 300] getdents64(3, [pid 298] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 447] creat("./bus", 000 [pid 446] creat("./bus", 000 [pid 444] rt_sigprocmask(SIG_SETMASK, [], [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 447] <... creat resumed>) = 4 [pid 446] <... creat resumed>) = 3 [pid 444] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] close(3 [pid 447] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] memfd_create("syzkaller", 0 [pid 300] <... close resumed>) = 0 [pid 447] <... futex resumed>) = 1 [pid 446] <... futex resumed>) = 1 [pid 445] <... write resumed>) = 262144 [pid 444] <... memfd_create resumed>) = 4 [pid 436] <... futex resumed>) = 0 [pid 435] <... futex resumed>) = 0 [pid 300] rmdir("./7" [pid 298] close(3 [pid 447] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 446] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] munmap(0x7f6218024000, 262144 [pid 444] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 436] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... rmdir resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 447] <... mount resumed>) = 0 [pid 446] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 445] <... munmap resumed>) = 0 [pid 444] <... mmap resumed>) = 0x7f6218024000 [pid 436] <... futex resumed>) = 0 [pid 435] <... futex resumed>) = 0 [ 24.276544][ T432] loop1: detected capacity change from 0 to 512 [ 24.298519][ T432] EXT4-fs (loop1): revision level too high, forcing read-only mode [ 24.306730][ T432] EXT4-fs error (device loop1): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # [ 24.312367][ T439] loop5: detected capacity change from 0 to 512 [pid 300] mkdir("./8", 0777 [pid 298] rmdir("./4" [pid 447] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 445] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 444] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 264966 [pid 436] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... mkdir resumed>) = 0 [pid 447] <... futex resumed>) = 0 [pid 446] <... mount resumed>) = 0 [pid 445] <... openat resumed>) = 5 [pid 444] <... write resumed>) = 264966 [pid 436] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 298] <... rmdir resumed>) = 0 [pid 447] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 446] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 445] ioctl(5, LOOP_SET_FD, 3 [pid 444] munmap(0x7f6218024000, 264966 [pid 436] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... openat resumed>) = 3 [pid 447] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 446] <... futex resumed>) = 1 [pid 444] <... munmap resumed>) = 0 [pid 436] <... futex resumed>) = 0 [pid 435] <... futex resumed>) = 0 [pid 300] ioctl(3, LOOP_CLR_FD [pid 298] mkdir("./5", 0777 [pid 447] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 446] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 444] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 436] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 446] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 444] <... openat resumed>) = 5 [pid 435] <... futex resumed>) = 0 [pid 300] close(3 [pid 447] <... open resumed>) = 6 [pid 446] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 445] <... ioctl resumed>) = 0 [pid 444] ioctl(5, LOOP_SET_FD, 4 [pid 440] <... open resumed>) = 6 [pid 439] <... ioctl resumed>) = 0 [pid 435] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 432] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 300] <... close resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 447] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] <... open resumed>) = 6 [pid 445] close(3 [pid 440] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] close(3 [pid 432] ioctl(5, LOOP_CLR_FD [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 447] <... futex resumed>) = 1 [pid 445] <... close resumed>) = 0 [pid 440] <... futex resumed>) = 1 [pid 439] <... close resumed>) = 0 [pid 436] <... futex resumed>) = 0 [pid 433] <... futex resumed>) = 0 [pid 432] <... ioctl resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 445] mkdir("./file0", 0777 [pid 440] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 439] mkdir("./file0", 0777 [pid 433] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 432] close(5 [pid 298] ioctl(3, LOOP_CLR_FD [pid 445] <... mkdir resumed>) = 0 [pid 440] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 439] <... mkdir resumed>) = 0 [pid 433] <... futex resumed>) = 0 [pid 432] <... close resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 445] mount("/dev/loop0", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 440] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 439] mount("/dev/loop5", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 433] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 432] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 446] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 447] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 440] <... socket resumed>) = 3 [pid 436] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 432] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 ./strace-static-x86_64: Process 448 attached [pid 447] <... socket resumed>) = 3 [pid 446] <... futex resumed>) = 1 [pid 440] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 436] <... futex resumed>) = 0 [pid 435] <... futex resumed>) = 0 [pid 432] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 427] exit_group(0 [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 448 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 448] set_robust_list(0x555556cc76a0, 24 [pid 447] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 440] <... futex resumed>) = 1 [pid 436] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 435] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = ? [pid 433] <... futex resumed>) = 0 [pid 432] <... futex resumed>) = ? [pid 427] <... exit_group resumed>) = ? [pid 448] <... set_robust_list resumed>) = 0 [pid 447] <... futex resumed>) = 0 [pid 446] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 440] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 436] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 435] <... futex resumed>) = 0 [pid 434] +++ exited with 0 +++ [pid 433] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 432] +++ exited with 0 +++ [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 451 [pid 448] chdir("./8" [pid 447] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 446] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 440] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 436] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 433] <... futex resumed>) = 0 [pid 440] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 433] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 440] <... mmap resumed>) = 0x20000000 [pid 440] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 433] <... futex resumed>) = 0 [pid 447] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 446] <... socket resumed>) = 7 [ 24.345455][ T432] EXT4-fs (loop1): get orphan inode failed [ 24.353904][ T445] loop0: detected capacity change from 0 to 512 [ 24.355120][ T432] EXT4-fs (loop1): mount failed [ 24.369232][ T444] loop3: detected capacity change from 0 to 517 [pid 440] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 436] <... futex resumed>) = 0 [pid 433] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 451 attached [pid 448] <... chdir resumed>) = 0 [pid 447] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 446] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... ioctl resumed>) = 0 [pid 440] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 436] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 433] <... futex resumed>) = 0 [pid 451] set_robust_list(0x555556cc76a0, 24 [pid 448] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 447] <... mmap resumed>) = 0x20000000 [pid 446] <... futex resumed>) = 1 [pid 444] close(4 [pid 440] memfd_create("syzkaller", 0 [pid 435] <... futex resumed>) = 0 [pid 448] <... prctl resumed>) = 0 [pid 447] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 444] <... close resumed>) = 0 [pid 435] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 448] setpgid(0, 0 [pid 447] <... futex resumed>) = 1 [pid 446] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 444] mkdir("./file0", 0777 [pid 436] <... futex resumed>) = 0 [pid 435] <... futex resumed>) = 0 [pid 448] <... setpgid resumed>) = 0 [pid 447] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 446] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 444] <... mkdir resumed>) = 0 [pid 440] <... memfd_create resumed>) = 7 [pid 436] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 435] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 448] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 447] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 446] <... mmap resumed>) = 0x20000000 [pid 436] <... futex resumed>) = 0 [pid 448] <... openat resumed>) = 3 [pid 447] memfd_create("syzkaller", 0 [pid 446] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 448] write(3, "1000", 4 [pid 447] <... memfd_create resumed>) = 7 [pid 446] <... futex resumed>) = 1 [pid 435] <... futex resumed>) = 0 [pid 448] <... write resumed>) = 4 [pid 447] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 446] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 435] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 448] close(3 [pid 447] <... mmap resumed>) = 0x7f620fc64000 [pid 446] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 435] <... futex resumed>) = 0 [pid 448] <... close resumed>) = 0 [pid 448] symlink("/dev/binderfs", "./binderfs" [pid 451] <... set_robust_list resumed>) = 0 [pid 448] <... symlink resumed>) = 0 [pid 446] memfd_create("syzkaller", 0 [pid 444] mount("/dev/loop3", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 440] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 448] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] <... memfd_create resumed>) = 4 [pid 444] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 448] <... futex resumed>) = 0 [pid 446] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 444] ioctl(5, LOOP_CLR_FD [pid 448] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 446] <... mmap resumed>) = 0x7f620fc65000 [pid 444] <... ioctl resumed>) = 0 [pid 448] <... rt_sigaction resumed>NULL, 8) = 0 [pid 446] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 444] close(5 [pid 448] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 446] <... write resumed>) = 65536 [pid 444] <... close resumed>) = 0 [pid 448] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 446] munmap(0x7f620fc65000, 65536 [pid 444] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 448] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 446] <... munmap resumed>) = 0 [pid 444] <... futex resumed>) = 0 [pid 448] <... mmap resumed>) = 0x7f6220445000 [pid 446] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 444] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 448] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 448] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[454]}, 88) = 454 [pid 448] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 447] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 448] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 447] <... write resumed>) = 65536 [pid 448] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 448] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 448] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 447] munmap(0x7f620fc64000, 65536 [pid 448] rt_sigprocmask(SIG_BLOCK, ~[], [pid 447] <... munmap resumed>) = 0 [pid 448] <... rt_sigprocmask resumed>[], 8) = 0 [pid 447] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 448] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 447] <... openat resumed>) = 8 [pid 447] ioctl(8, LOOP_SET_FD, 7 [pid 448] <... clone3 resumed> => {parent_tid=[455]}, 88) = 455 [pid 448] rt_sigprocmask(SIG_SETMASK, [], [pid 447] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 448] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 448] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 447] ioctl(8, LOOP_CLR_FD [pid 448] <... futex resumed>) = 0 [pid 448] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 447] <... ioctl resumed>) = 0 [pid 451] chdir("./5" [pid 440] <... mmap resumed>) = 0x7f620fc64000 [pid 447] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 447] close(8) = 0 [pid 447] close(7) = 0 [pid 440] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 68515 [pid 447] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 447] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] <... mount resumed>) = 0 ./strace-static-x86_64: Process 455 attached ./strace-static-x86_64: Process 454 attached [pid 451] <... chdir resumed>) = 0 [pid 446] <... openat resumed>) = 5 [pid 445] openat(AT_FDCWD, 0x20000000, O_RDONLY|O_DIRECTORY [pid 440] <... write resumed>) = 68515 [pid 427] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=427, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 451] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 446] ioctl(5, LOOP_SET_FD, 4 [pid 445] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 440] munmap(0x7f620fc64000, 68515 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 451] <... prctl resumed>) = 0 [pid 446] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 445] ioctl(5, LOOP_CLR_FD [pid 440] <... munmap resumed>) = 0 [pid 451] setpgid(0, 0 [pid 446] ioctl(5, LOOP_CLR_FD [pid 445] <... ioctl resumed>) = 0 [pid 440] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] <... restart_syscall resumed>) = 0 [pid 451] <... setpgid resumed>) = 0 [pid 446] <... ioctl resumed>) = 0 [pid 445] close(5 [pid 440] <... openat resumed>) = 8 [pid 451] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 445] <... close resumed>) = 0 [pid 440] ioctl(8, LOOP_SET_FD, 7 [pid 451] <... openat resumed>) = 3 [pid 445] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 451] write(3, "1000", 4 [pid 445] <... futex resumed>) = 0 [pid 440] ioctl(8, LOOP_CLR_FD [pid 451] <... write resumed>) = 4 [pid 445] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 440] <... ioctl resumed>) = 0 [pid 436] exit_group(0 [pid 297] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 451] close(3 [pid 446] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 446] close(5) = 0 [pid 446] close(4) = 0 [pid 447] <... futex resumed>) = ? [pid 436] <... exit_group resumed>) = ? [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 447] +++ exited with 0 +++ [pid 451] <... close resumed>) = 0 [pid 446] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 445] <... futex resumed>) = ? [pid 297] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 451] symlink("/dev/binderfs", "./binderfs" [pid 446] <... futex resumed>) = 0 [pid 451] <... symlink resumed>) = 0 [pid 446] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] +++ exited with 0 +++ [pid 436] +++ exited with 0 +++ [pid 297] <... openat resumed>) = 3 [pid 451] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] ioctl(8, LOOP_SET_FD, 7 [pid 451] <... futex resumed>) = 0 [pid 440] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 451] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 440] close(8 [pid 435] exit_group(0 [pid 297] newfstatat(3, "", [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=436, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 451] <... rt_sigaction resumed>NULL, 8) = 0 [pid 446] <... futex resumed>) = ? [pid 444] <... futex resumed>) = ? [pid 440] <... close resumed>) = 0 [pid 435] <... exit_group resumed>) = ? [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 451] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 446] +++ exited with 0 +++ [pid 444] +++ exited with 0 +++ [pid 440] close(7 [pid 451] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 440] <... close resumed>) = 0 [pid 297] getdents64(3, [pid 296] <... restart_syscall resumed>) = 0 [pid 451] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 440] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 451] <... mmap resumed>) = 0x7f6220445000 [pid 440] <... futex resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 451] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 440] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 451] <... mprotect resumed>) = 0 [pid 451] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] <... umount2 resumed>) = 0 [pid 296] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 451] <... rt_sigprocmask resumed>[], 8) = 0 [pid 451] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 297] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 451] <... clone3 resumed> => {parent_tid=[456]}, 88) = 456 [pid 297] newfstatat(AT_FDCWD, "./5/bus", [pid 451] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... openat resumed>) = 3 [pid 451] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] newfstatat(3, "", ./strace-static-x86_64: Process 456 attached [pid 451] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] unlink("./5/bus" [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 456] set_robust_list(0x7f62204659a0, 24 [pid 451] <... futex resumed>) = 0 [pid 451] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] <... set_robust_list resumed>) = 0 [pid 451] <... futex resumed>) = 0 [pid 448] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 297] <... unlink resumed>) = 0 [pid 296] getdents64(3, [pid 456] rt_sigprocmask(SIG_SETMASK, [], [pid 455] set_robust_list(0x7f62204449a0, 24 [pid 454] set_robust_list(0x7f62204659a0, 24 [pid 451] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 448] futex(0x7f62205316ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 456] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 455] <... set_robust_list resumed>) = 0 [pid 454] <... set_robust_list resumed>) = 0 [pid 451] <... mmap resumed>) = 0x7f6220424000 [pid 448] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 451] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 448] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] newfstatat(AT_FDCWD, "./5/binderfs", [ 24.388726][ T445] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodiscard,barrier,nouid32,grpquota,,errors=continue. Quota mode: writeback. [ 24.403561][ T439] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 24.408698][ T445] ext4 filesystem being mounted at /root/syzkaller.sY6u5M/5/file0 supports timestamps until 2038 (0x7fffffff) [ 24.412427][ T439] EXT4-fs error (device loop5): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # [ 24.438590][ T439] EXT4-fs (loop5): get orphan inode failed [pid 296] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 456] memfd_create("syzkaller", 0 [pid 455] rt_sigprocmask(SIG_SETMASK, [], [pid 454] rt_sigprocmask(SIG_SETMASK, [], [pid 451] <... mprotect resumed>) = 0 [pid 448] <... mmap resumed>) = 0x7f6220403000 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 456] <... memfd_create resumed>) = 3 [pid 455] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 454] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 448] mprotect(0x7f6220404000, 131072, PROT_READ|PROT_WRITE [pid 297] unlink("./5/binderfs" [pid 296] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 456] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 455] creat("./bus", 000 [pid 454] memfd_create("syzkaller", 0 [pid 448] <... mprotect resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 456] <... mmap resumed>) = 0x7f6218024000 [pid 455] <... creat resumed>) = 3 [pid 454] <... memfd_create resumed>) = 4 [pid 448] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] newfstatat(AT_FDCWD, "./5/bus", [pid 456] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 455] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 454] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 448] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 455] <... futex resumed>) = 0 [pid 454] <... mmap resumed>) = 0x7f6218003000 [pid 451] rt_sigprocmask(SIG_BLOCK, ~[], [pid 448] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220423990, parent_tid=0x7f6220423990, exit_signal=0, stack=0x7f6220403000, stack_size=0x20300, tls=0x7f62204236c0} [pid 297] newfstatat(AT_FDCWD, "./5/file0", [pid 296] unlink("./5/bus" [pid 455] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 454] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 451] <... rt_sigprocmask resumed>[], 8) = 0 [pid 439] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... unlink resumed>) = 0 [pid 456] <... write resumed>) = 262144 [pid 454] <... write resumed>) = 262144 [pid 451] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 448] <... clone3 resumed> => {parent_tid=[457]}, 88) = 457 [pid 297] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 448] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 454] munmap(0x7f6218003000, 262144 [pid 448] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] openat(AT_FDCWD, "./5/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] newfstatat(AT_FDCWD, "./5/binderfs", [pid 456] munmap(0x7f6218024000, 262144 [pid 454] <... munmap resumed>) = 0 [pid 448] futex(0x7f62205316e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] ioctl(5, LOOP_CLR_FD [pid 297] <... openat resumed>) = 4 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 454] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 448] <... futex resumed>) = 0 [pid 297] newfstatat(4, "", [pid 296] unlink("./5/binderfs" [pid 454] <... openat resumed>) = 5 [pid 451] <... clone3 resumed> => {parent_tid=[459]}, 88) = 459 [pid 448] futex(0x7f62205316ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... ioctl resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... unlink resumed>) = 0 ./strace-static-x86_64: Process 459 attached ./strace-static-x86_64: Process 457 attached [pid 456] <... munmap resumed>) = 0 [pid 454] ioctl(5, LOOP_SET_FD, 4 [pid 297] getdents64(4, [pid 296] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 451] rt_sigprocmask(SIG_SETMASK, [], [pid 439] close(5 [pid 451] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 439] <... close resumed>) = 0 [pid 451] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 451] <... futex resumed>) = 0 [pid 451] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... futex resumed>) = 0 [pid 439] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 459] set_robust_list(0x7f62204449a0, 24 [pid 433] exit_group(0 [pid 440] <... futex resumed>) = ? [pid 439] <... futex resumed>) = ? [pid 433] <... exit_group resumed>) = ? [pid 440] +++ exited with 0 +++ [pid 459] <... set_robust_list resumed>) = 0 [pid 457] set_robust_list(0x7f62204239a0, 24 [pid 456] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 454] <... ioctl resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 457] <... set_robust_list resumed>) = 0 [pid 456] <... openat resumed>) = 4 [pid 297] getdents64(4, 0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./5/file0") = 0 [pid 297] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./5") = 0 [pid 297] mkdir("./6", 0777 [pid 459] rt_sigprocmask(SIG_SETMASK, [], [pid 457] rt_sigprocmask(SIG_SETMASK, [], [pid 456] ioctl(4, LOOP_SET_FD, 3 [pid 454] close(4 [pid 459] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 460 ./strace-static-x86_64: Process 460 attached [pid 460] set_robust_list(0x555556cc76a0, 24) = 0 [pid 460] chdir("./6") = 0 [pid 460] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 460] setpgid(0, 0) = 0 [pid 460] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 460] write(3, "1000", 4) = 4 [pid 460] close(3) = 0 [pid 460] symlink("/dev/binderfs", "./binderfs") = 0 [pid 460] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 460] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 460] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 460] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 460] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 460] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 460] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[461]}, 88) = 461 [pid 460] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 460] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 460] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 460] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 460] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 460] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 460] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[462]}, 88) = 462 [pid 460] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 460] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 460] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 462 attached [pid 462] set_robust_list(0x7f62204449a0, 24) = 0 [pid 462] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 462] creat("./bus", 000) = 3 [pid 462] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 460] <... futex resumed>) = 0 [pid 460] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 460] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] <... futex resumed>) = 1 [pid 462] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 462] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 460] <... futex resumed>) = 0 [pid 460] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 460] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] <... futex resumed>) = 1 [pid 456] <... ioctl resumed>) = 0 [pid 457] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 454] <... close resumed>) = 0 [pid 459] creat("./bus", 000 [pid 456] close(3 [pid 462] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 462] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 460] <... futex resumed>) = 0 [pid 460] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 460] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] <... futex resumed>) = 1 [pid 462] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE) = 5 [pid 462] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 461 attached ) = 1 [pid 459] <... creat resumed>) = 5 [pid 457] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 456] <... close resumed>) = 0 [pid 454] mkdir("./file0", 0777 [pid 459] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] <... mount resumed>) = 0 [pid 454] <... mkdir resumed>) = 0 [pid 435] +++ exited with 0 +++ [pid 459] <... futex resumed>) = 1 [pid 457] futex(0x7f62205316ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 454] mount("/dev/loop4", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 451] <... futex resumed>) = 0 [pid 459] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 457] <... futex resumed>) = 1 [pid 451] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=435, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 459] <... mount resumed>) = 0 [pid 457] futex(0x7f62205316e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 451] <... futex resumed>) = 0 [pid 459] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 451] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] <... futex resumed>) = 0 [pid 451] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 459] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 451] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] <... open resumed>) = 3 [pid 451] <... futex resumed>) = 0 [pid 459] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 451] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] <... futex resumed>) = 0 [pid 451] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 459] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 451] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] <... socket resumed>) = 6 [pid 451] <... futex resumed>) = 0 [pid 459] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 451] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] <... futex resumed>) = 0 [pid 451] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 448] <... futex resumed>) = 0 [pid 459] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 3, 0 [pid 451] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] <... mmap resumed>) = 0x20000000 [pid 451] <... futex resumed>) = 0 [pid 459] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 451] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 459] <... futex resumed>) = 0 [pid 451] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 462] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 461] set_robust_list(0x7f62204659a0, 24 [pid 460] <... futex resumed>) = 0 [pid 459] memfd_create("syzkaller", 0 [pid 456] mkdir(0x20000000, 0777 [pid 451] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 448] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 460] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... futex resumed>) = 0 [pid 451] <... futex resumed>) = 0 [pid 448] <... futex resumed>) = 1 [pid 462] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 460] <... futex resumed>) = 0 [pid 459] <... memfd_create resumed>) = 7 [pid 455] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 461] <... set_robust_list resumed>) = 0 [pid 448] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 460] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 455] <... open resumed>) = 4 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 455] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 455] <... futex resumed>) = 1 [pid 448] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 455] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(3, "", [pid 455] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 448] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 455] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 448] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] getdents64(3, [pid 459] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 455] <... socket resumed>) = 6 [pid 299] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 459] <... mmap resumed>) = 0x7f620fc64000 [pid 455] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 455] <... futex resumed>) = 1 [pid 448] <... futex resumed>) = 0 [pid 455] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = 0 [pid 459] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 455] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 448] <... futex resumed>) = 0 [pid 299] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 455] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0 [pid 448] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 459] <... write resumed>) = 65536 [pid 455] <... mmap resumed>) = 0x20000000 [pid 299] newfstatat(AT_FDCWD, "./5/bus", [pid 459] munmap(0x7f620fc64000, 65536 [pid 455] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 455] <... futex resumed>) = 1 [pid 448] <... futex resumed>) = 0 [pid 299] unlink("./5/bus" [pid 459] <... munmap resumed>) = 0 [pid 455] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... unlink resumed>) = 0 [pid 459] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 455] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 448] <... futex resumed>) = 0 [pid 299] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 455] memfd_create("syzkaller", 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 459] <... openat resumed>) = 8 [pid 455] <... memfd_create resumed>) = 7 [pid 299] newfstatat(AT_FDCWD, "./5/binderfs", [pid 459] ioctl(8, LOOP_SET_FD, 7 [pid 455] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 459] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 455] <... mmap resumed>) = 0x7f620fc43000 [pid 299] unlink("./5/binderfs" [pid 459] ioctl(8, LOOP_CLR_FD [pid 456] <... mkdir resumed>) = 0 [pid 455] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 299] <... unlink resumed>) = 0 [pid 462] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0 [pid 461] rt_sigprocmask(SIG_SETMASK, [], [pid 459] <... ioctl resumed>) = 0 [pid 456] mount("/dev/loop2", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [ 24.460953][ T439] EXT4-fs (loop5): mount failed [ 24.470884][ T454] loop4: detected capacity change from 0 to 512 [ 24.480471][ T456] loop2: detected capacity change from 0 to 512 [pid 455] <... write resumed>) = 65536 [pid 299] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 455] munmap(0x7f620fc43000, 65536 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 456] <... mount resumed>) = -1 ENODEV (No such device) [pid 455] <... munmap resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./5/file0", [pid 461] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 462] <... mmap resumed>) = 0x20000000 [pid 456] ioctl(4, LOOP_CLR_FD [pid 455] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 455] <... openat resumed>) = 8 [pid 299] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 455] ioctl(8, LOOP_SET_FD, 7 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 455] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 299] openat(AT_FDCWD, "./5/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 455] ioctl(8, LOOP_CLR_FD [pid 299] <... openat resumed>) = 4 [pid 455] <... ioctl resumed>) = 0 [pid 299] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(4, 0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./5/file0") = 0 [pid 299] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 299] close(3 [pid 455] ioctl(8, LOOP_SET_FD, 7 [pid 299] <... close resumed>) = 0 [pid 455] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 299] rmdir("./5" [pid 455] close(8 [pid 299] <... rmdir resumed>) = 0 [pid 455] <... close resumed>) = 0 [pid 299] mkdir("./6", 0777 [pid 455] close(7 [pid 299] <... mkdir resumed>) = 0 [pid 455] <... close resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 455] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... openat resumed>) = 3 [pid 455] <... futex resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 455] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 465 ./strace-static-x86_64: Process 465 attached [pid 465] set_robust_list(0x555556cc76a0, 24) = 0 [pid 465] chdir("./6") = 0 [pid 465] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 465] setpgid(0, 0) = 0 [pid 465] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 465] write(3, "1000", 4) = 4 [pid 465] close(3) = 0 [pid 465] symlink("/dev/binderfs", "./binderfs") = 0 [pid 465] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 465] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 465] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 465] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 465] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 465] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[466]}, 88) = 466 [pid 465] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 465] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 465] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 465] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 465] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[467]}, 88) = 467 [pid 465] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 465] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 467 attached [pid 467] set_robust_list(0x7f62204449a0, 24) = 0 [pid 467] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 467] creat("./bus", 000) = 3 [pid 467] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] <... futex resumed>) = 0 [pid 465] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 467] <... futex resumed>) = 1 [pid 467] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL) = 0 [pid 467] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] <... futex resumed>) = 0 [pid 465] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 465] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 467] <... futex resumed>) = 1 [pid 459] ioctl(8, LOOP_SET_FD, 7 [pid 467] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 467] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 439] +++ exited with 0 +++ [pid 433] +++ exited with 0 +++ [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=433, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 301] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 301] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 301] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 301] getdents64(3, 0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 301] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 459] close(8 [pid 301] <... umount2 resumed>) = 0 [pid 459] <... close resumed>) = 0 [pid 301] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 462] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 461] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200005c4} --- [pid 459] close(7 [pid 456] <... ioctl resumed>) = 0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = 0 [pid 301] newfstatat(AT_FDCWD, "./6/bus", [pid 462] <... futex resumed>) = ? [pid 460] <... futex resumed>) = -1 (errno 18446744073709551555) [pid 459] <... close resumed>) = 0 [pid 456] close(4 [pid 301] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 466 attached [pid 459] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] <... close resumed>) = 0 [pid 301] unlink("./6/bus" [pid 296] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 467] <... futex resumed>) = 1 [pid 466] set_robust_list(0x7f62204659a0, 24 [pid 465] <... futex resumed>) = 0 [pid 462] +++ killed by SIGBUS +++ [pid 459] <... futex resumed>) = 0 [pid 456] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... unlink resumed>) = 0 [pid 301] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 301] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] unlink("./6/binderfs") = 0 [pid 301] umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 301] newfstatat(AT_FDCWD, "./6/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 301] openat(AT_FDCWD, "./6/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 301] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 301] getdents64(4, 0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 301] getdents64(4, 0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 301] close(4) = 0 [pid 301] rmdir("./6/file0") = 0 [pid 301] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 301] close(3) = 0 [pid 301] rmdir("./6") = 0 [pid 301] mkdir("./7", 0777) = 0 [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 301] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 301] close(3) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 468 [pid 459] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 456] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 466] <... set_robust_list resumed>) = 0 [pid 465] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 461] +++ killed by SIGBUS +++ [pid 460] +++ killed by SIGBUS +++ [pid 456] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 451] exit_group(0 [pid 296] newfstatat(AT_FDCWD, "./5/file0", [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=460, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 451] <... exit_group resumed>) = ? [pid 459] <... futex resumed>) = 230 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 456] <... futex resumed>) = ? [pid 459] +++ exited with 0 +++ [pid 467] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE) = 5 [pid 467] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 467] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] umount2("./5/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 456] +++ exited with 0 +++ [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./5/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... openat resumed>) = 4 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(3, 0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 297] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] newfstatat(4, "", [pid 297] <... umount2 resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 467] <... futex resumed>) = 0 [pid 465] <... futex resumed>) = 1 [pid 296] getdents64(4, [pid 467] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 465] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] newfstatat(AT_FDCWD, "./6/bus", [pid 296] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 465] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] unlink("./6/bus" [pid 296] getdents64(4, [pid 297] <... unlink resumed>) = 0 [pid 465] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 297] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 467] <... futex resumed>) = 0 [pid 465] <... futex resumed>) = 1 [pid 296] close(4 [pid 467] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 468 attached [pid 467] <... mmap resumed>) = 0x20000000 [pid 466] rt_sigprocmask(SIG_SETMASK, [], [pid 465] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] newfstatat(AT_FDCWD, "./6/binderfs", [pid 296] <... close resumed>) = 0 [pid 467] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 465] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] rmdir("./5/file0" [pid 468] set_robust_list(0x555556cc76a0, 24 [pid 466] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 468] <... set_robust_list resumed>) = 0 [pid 467] <... futex resumed>) = 0 [pid 466] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x200005c4} --- [pid 465] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] unlink("./6/binderfs" [pid 296] <... rmdir resumed>) = 0 [pid 296] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./5" [pid 465] <... futex resumed>) = ? [pid 297] <... unlink resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 468] chdir("./7" [pid 296] mkdir("./6", 0777 [pid 468] <... chdir resumed>) = 0 [pid 467] +++ killed by SIGBUS +++ [pid 297] getdents64(3, [pid 296] <... mkdir resumed>) = 0 [pid 454] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 297] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 468] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 454] ioctl(5, LOOP_CLR_FD [pid 297] close(3 [pid 296] <... openat resumed>) = 3 [pid 297] <... close resumed>) = 0 [pid 297] rmdir("./6" [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] <... rmdir resumed>) = 0 [pid 466] +++ killed by SIGBUS +++ [pid 468] <... prctl resumed>) = 0 [pid 465] +++ killed by SIGBUS +++ [pid 454] <... ioctl resumed>) = 0 [pid 297] mkdir("./7", 0777 [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=465, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=1} --- [pid 468] setpgid(0, 0 [pid 454] close(5 [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 297] <... mkdir resumed>) = 0 [pid 299] <... restart_syscall resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR./strace-static-x86_64: Process 469 attached [pid 468] <... setpgid resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 296] <... clone resumed>, child_tidptr=0x555556cc7690) = 469 [pid 469] set_robust_list(0x555556cc76a0, 24 [pid 454] <... close resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 299] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] close(3 [pid 299] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... close resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 469] <... set_robust_list resumed>) = 0 [pid 468] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 454] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(3, "", ./strace-static-x86_64: Process 470 attached {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 454] <... futex resumed>) = 0 [pid 299] getdents64(3, [pid 297] <... clone resumed>, child_tidptr=0x555556cc7690) = 470 [pid 454] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 448] exit_group(0 [pid 299] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 457] <... futex resumed>) = ? [pid 455] <... futex resumed>) = ? [pid 448] <... exit_group resumed>) = ? [pid 299] <... umount2 resumed>) = 0 [pid 455] +++ exited with 0 +++ [pid 299] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./6/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./6/bus") = 0 [pid 457] +++ exited with 0 +++ [pid 299] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 454] <... futex resumed>) = ? [pid 299] unlink("./6/binderfs") = 0 [pid 299] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./6" [pid 469] chdir("./6" [pid 468] <... openat resumed>) = 3 [pid 299] <... rmdir resumed>) = 0 [pid 299] mkdir("./7", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 469] <... chdir resumed>) = 0 [pid 468] write(3, "1000", 4 [pid 299] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD [pid 469] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 468] <... write resumed>) = 4 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 469] <... prctl resumed>) = 0 [pid 468] close(3 [pid 299] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 469] setpgid(0, 0 [pid 468] <... close resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556cc7690) = 471 [pid 470] set_robust_list(0x555556cc76a0, 24 [pid 468] symlink("/dev/binderfs", "./binderfs" [pid 470] <... set_robust_list resumed>) = 0 [pid 470] chdir("./7") = 0 [pid 469] <... setpgid resumed>) = 0 [pid 470] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 470] setpgid(0, 0) = 0 [pid 470] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 470] write(3, "1000", 4) = 4 [pid 470] close(3) = 0 [pid 470] symlink("/dev/binderfs", "./binderfs") = 0 [pid 468] <... symlink resumed>) = 0 [pid 470] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 470] <... futex resumed>) = 0 [pid 470] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 470] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 468] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 470] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 470] rt_sigprocmask(SIG_BLOCK, ~[], [pid 468] <... futex resumed>) = 0 [pid 470] <... rt_sigprocmask resumed>[], 8) = 0 [pid 470] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[472]}, 88) = 472 [pid 468] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 470] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 470] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 468] <... rt_sigaction resumed>NULL, 8) = 0 [pid 470] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 469] <... openat resumed>) = 3 [pid 470] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 468] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 470] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[473]}, 88) = 473 [pid 470] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 470] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 470] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 473 attached [pid 468] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 473] set_robust_list(0x7f62204449a0, 24) = 0 [pid 473] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 473] creat("./bus", 000 [pid 468] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 469] write(3, "1000", 4./strace-static-x86_64: Process 472 attached [pid 472] set_robust_list(0x7f62204659a0, 24) = 0 [pid 472] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 471 attached [pid 469] <... write resumed>) = 4 [pid 468] <... mmap resumed>) = 0x7f6220445000 [pid 468] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 469] close(3 [pid 472] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 472] memfd_create("syzkaller", 0 [pid 468] <... mprotect resumed>) = 0 [pid 471] set_robust_list(0x555556cc76a0, 24 [pid 469] <... close resumed>) = 0 [pid 472] <... memfd_create resumed>) = 4 [pid 472] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218024000 [pid 469] symlink("/dev/binderfs", "./binderfs" [pid 468] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 468] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 469] <... symlink resumed>) = 0 [pid 469] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 474 attached [pid 473] <... creat resumed>) = 3 [pid 471] <... set_robust_list resumed>) = 0 [pid 469] <... futex resumed>) = 0 [pid 468] <... clone3 resumed> => {parent_tid=[474]}, 88) = 474 [pid 473] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] chdir("./7" [pid 469] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 468] rt_sigprocmask(SIG_SETMASK, [], [pid 472] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 474] set_robust_list(0x7f62204659a0, 24 [pid 473] <... futex resumed>) = 1 [pid 471] <... chdir resumed>) = 0 [pid 470] <... futex resumed>) = 0 [pid 469] <... rt_sigaction resumed>NULL, 8) = 0 [pid 468] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 470] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 468] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 470] <... futex resumed>) = 0 [pid 468] <... futex resumed>) = 0 [pid 469] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 470] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 468] <... futex resumed>) = 0 [ 24.501616][ T463] EXT4-fs warning (device loop4): kmmpd:170: kmmpd being stopped since MMP feature has been disabled. [ 24.514258][ T454] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 24.525319][ T454] EXT4-fs error (device loop4): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # [ 24.541608][ T454] EXT4-fs (loop4): get orphan inode failed [ 24.550930][ T454] EXT4-fs (loop4): mount failed [pid 472] <... write resumed>) = 262144 [pid 469] <... mmap resumed>) = 0x7f6220445000 [pid 468] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 474] <... set_robust_list resumed>) = 0 [pid 474] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 474] memfd_create("syzkaller", 0) = 3 [pid 451] +++ exited with 0 +++ [pid 474] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=451, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 474] <... mmap resumed>) = 0x7f6218045000 [pid 298] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 298] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 472] munmap(0x7f6218024000, 262144 [pid 298] <... openat resumed>) = 3 [pid 472] <... munmap resumed>) = 0 [pid 298] newfstatat(3, "", [pid 472] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 472] <... openat resumed>) = 5 [pid 298] getdents64(3, [pid 472] ioctl(5, LOOP_SET_FD, 4 [pid 298] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 128 [pid 474] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 473] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 471] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 469] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 468] <... mmap resumed>) = 0x7f6218024000 [pid 474] <... write resumed>) = 262144 [pid 472] <... ioctl resumed>) = 0 [pid 471] <... prctl resumed>) = 0 [pid 469] <... mprotect resumed>) = 0 [pid 468] mprotect(0x7f6218025000, 131072, PROT_READ|PROT_WRITE [pid 298] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 473] <... mount resumed>) = 0 [pid 471] setpgid(0, 0 [pid 469] rt_sigprocmask(SIG_BLOCK, ~[], [pid 468] <... mprotect resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 473] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... setpgid resumed>) = 0 [pid 469] <... rt_sigprocmask resumed>[], 8) = 0 [pid 468] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 473] <... futex resumed>) = 1 [pid 471] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 470] <... futex resumed>) = 0 [pid 469] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 468] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 473] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 470] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 468] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6218044990, parent_tid=0x7f6218044990, exit_signal=0, stack=0x7f6218024000, stack_size=0x20300, tls=0x7f62180446c0} [pid 298] newfstatat(AT_FDCWD, "./5/bus", [pid 470] <... futex resumed>) = 0 [pid 469] <... clone3 resumed> => {parent_tid=[475]}, 88) = 475 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 473] <... open resumed>) = 6 [pid 470] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 469] rt_sigprocmask(SIG_SETMASK, [], [pid 298] unlink("./5/bus" [pid 474] munmap(0x7f6218045000, 262144 [pid 473] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... openat resumed>) = 3 [pid 469] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 468] <... clone3 resumed> => {parent_tid=[476]}, 88) = 476 [pid 298] <... unlink resumed>) = 0 [pid 473] <... futex resumed>) = 1 [pid 472] close(4 [pid 471] write(3, "1000", 4 [pid 470] <... futex resumed>) = 0 [pid 469] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 473] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 471] <... write resumed>) = 4 [pid 470] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... futex resumed>) = 0 [pid 468] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 473] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 471] close(3 [pid 470] <... futex resumed>) = 0 [pid 469] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 468] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] newfstatat(AT_FDCWD, "./5/binderfs", [pid 473] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 471] <... close resumed>) = 0 [pid 470] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 469] <... futex resumed>) = 0 [pid 468] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 473] <... socket resumed>) = 7 [pid 471] symlink("/dev/binderfs", "./binderfs" [pid 469] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 468] <... futex resumed>) = 0 [pid 298] unlink("./5/binderfs" [pid 473] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... mmap resumed>) = 0x7f6220424000 [pid 468] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] <... symlink resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 473] <... futex resumed>) = 1 [pid 470] <... futex resumed>) = 0 [pid 469] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 298] umount2("./5/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 473] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 471] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... mprotect resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 476 attached [pid 470] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./5/ext4", [pid 476] set_robust_list(0x7f62180449a0, 24 [pid 473] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 471] <... futex resumed>) = 0 [pid 470] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 469] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 476] <... set_robust_list resumed>) = 0 [pid 473] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 471] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 469] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] umount2("./5/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 476] rt_sigprocmask(SIG_SETMASK, [], [pid 473] <... mmap resumed>) = 0x20000000 [pid 471] <... rt_sigaction resumed>NULL, 8) = 0 [pid 469] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 476] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 473] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] openat(AT_FDCWD, "./5/ext4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 476] creat("./bus", 000 [pid 473] <... futex resumed>) = 1 [pid 471] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 470] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 4 ./strace-static-x86_64: Process 477 attached ./strace-static-x86_64: Process 475 attached [pid 476] <... creat resumed>) = 4 [pid 474] <... munmap resumed>) = 0 [pid 473] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 472] <... close resumed>) = 0 [pid 471] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 470] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... clone3 resumed> => {parent_tid=[477]}, 88) = 477 [pid 298] newfstatat(4, "", [pid 476] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 476] <... futex resumed>) = 1 [pid 468] <... futex resumed>) = 0 [pid 298] getdents64(4, [pid 476] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 468] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 476] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 468] <... futex resumed>) = 0 [pid 298] getdents64(4, [pid 476] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 468] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 476] <... mount resumed>) = 0 [pid 473] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 471] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 469] rt_sigprocmask(SIG_SETMASK, [], [pid 454] +++ exited with 0 +++ [pid 448] +++ exited with 0 +++ [pid 298] close(4 [pid 476] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=448, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 298] <... close resumed>) = 0 [pid 476] <... futex resumed>) = 1 [pid 468] <... futex resumed>) = 0 [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 298] rmdir("./5/ext4" [pid 476] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 468] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... restart_syscall resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 469] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 477] set_robust_list(0x7f62204449a0, 24 [pid 476] <... open resumed>) = 5 [pid 475] set_robust_list(0x7f62204659a0, 24 [pid 473] memfd_create("syzkaller", 0 [pid 471] <... mmap resumed>) = 0x7f6220445000 [pid 469] <... futex resumed>) = 0 [pid 468] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 477] <... set_robust_list resumed>) = 0 [pid 476] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 475] <... set_robust_list resumed>) = 0 [pid 473] <... memfd_create resumed>) = 4 [pid 471] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 469] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 477] rt_sigprocmask(SIG_SETMASK, [], [pid 476] <... futex resumed>) = 0 [pid 475] rt_sigprocmask(SIG_SETMASK, [], [pid 473] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 471] <... mprotect resumed>) = 0 [pid 468] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] close(3 [pid 477] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 476] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 475] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 473] <... mmap resumed>) = 0x7f620fc64000 [pid 471] rt_sigprocmask(SIG_BLOCK, ~[], [pid 468] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... close resumed>) = 0 [pid 477] creat("./bus", 000 [pid 476] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 475] memfd_create("syzkaller", 0 [pid 471] <... rt_sigprocmask resumed>[], 8) = 0 [pid 468] <... futex resumed>) = 0 [pid 300] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] rmdir("./5" [pid 477] <... creat resumed>) = 3 [pid 476] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 475] <... memfd_create resumed>) = 4 [pid 473] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 471] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 468] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... openat resumed>) = 3 [pid 298] <... rmdir resumed>) = 0 [pid 477] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... socket resumed>) = 6 [pid 475] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 300] newfstatat(3, "", [pid 298] mkdir("./6", 0777 [pid 477] <... futex resumed>) = 1 [pid 476] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 475] <... mmap resumed>) = 0x7f6218024000 [pid 474] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 473] <... write resumed>) = 65536 [pid 471] <... clone3 resumed> => {parent_tid=[478]}, 88) = 478 [pid 469] <... futex resumed>) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 477] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 476] <... futex resumed>) = 1 [pid 475] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 474] <... openat resumed>) = 7 [pid 473] munmap(0x7f620fc64000, 65536 [pid 471] rt_sigprocmask(SIG_SETMASK, [], [pid 469] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 468] <... futex resumed>) = 0 [pid 300] getdents64(3, [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 477] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 476] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 475] <... write resumed>) = 262144 [pid 474] ioctl(7, LOOP_SET_FD, 3 [pid 473] <... munmap resumed>) = 0 [pid 472] mkdir(0x20000000, 0777 [pid 471] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 469] <... futex resumed>) = 0 [pid 468] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 298] <... openat resumed>) = 3 [pid 477] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 476] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 475] munmap(0x7f6218024000, 262144 [pid 473] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 471] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] <... futex resumed>) = 0 [pid 300] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] ioctl(3, LOOP_CLR_FD [pid 477] <... mount resumed>) = 0 [pid 476] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 475] <... munmap resumed>) = 0 [pid 468] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 477] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] <... mmap resumed>) = 0x20000000 [pid 475] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 473] <... openat resumed>) = 8 [pid 471] <... futex resumed>) = 0 [pid 469] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] <... umount2 resumed>) = 0 [pid 298] close(3./strace-static-x86_64: Process 478 attached [pid 477] <... futex resumed>) = 0 [pid 476] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 475] <... openat resumed>) = 5 [pid 473] ioctl(8, LOOP_SET_FD, 4 [pid 471] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... close resumed>) = 0 [pid 478] set_robust_list(0x7f62204659a0, 24 [pid 477] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 476] <... futex resumed>) = 1 [pid 475] ioctl(5, LOOP_SET_FD, 4 [pid 473] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 471] <... futex resumed>) = 0 [pid 469] <... futex resumed>) = 0 [pid 468] <... futex resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 479 attached [pid 478] <... set_robust_list resumed>) = 0 [pid 477] <... open resumed>) = 6 [pid 475] <... ioctl resumed>) = 0 [pid 474] <... ioctl resumed>) = 0 [pid 473] ioctl(8, LOOP_CLR_FD [pid 472] <... mkdir resumed>) = 0 [pid 471] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 469] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] newfstatat(AT_FDCWD, "./8/bus", [pid 479] set_robust_list(0x555556cc76a0, 24 [pid 475] close(4 [pid 474] close(3 [pid 473] <... ioctl resumed>) = 0 [pid 472] mount("/dev/loop1", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 471] <... mmap resumed>) = 0x7f6220424000 [pid 479] <... set_robust_list resumed>) = 0 [pid 475] <... close resumed>) = 0 [pid 474] <... close resumed>) = 0 [pid 472] <... mount resumed>) = -1 ENODEV (No such device) [pid 471] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 468] <... futex resumed>) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 479 [pid 479] chdir("./6" [pid 475] mkdir("./file0", 0777 [pid 474] mkdir(0x20000000, 0777 [pid 472] ioctl(5, LOOP_CLR_FD [pid 471] <... mprotect resumed>) = 0 [pid 300] unlink("./8/bus" [pid 479] <... chdir resumed>) = 0 [pid 475] <... mkdir resumed>) = 0 [pid 474] <... mkdir resumed>) = 0 [pid 473] ioctl(8, LOOP_SET_FD, 4 [pid 472] <... ioctl resumed>) = 0 [pid 471] rt_sigprocmask(SIG_BLOCK, ~[], [pid 479] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 475] mount("/dev/loop0", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 474] mount("/dev/loop5", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 473] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 472] close(5 [pid 471] <... rt_sigprocmask resumed>[], 8) = 0 [pid 300] <... unlink resumed>) = 0 [pid 479] <... prctl resumed>) = 0 [pid 474] <... mount resumed>) = -1 ENODEV (No such device) [pid 473] close(8 [pid 472] <... close resumed>) = 0 [pid 471] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 479] setpgid(0, 0 [pid 474] ioctl(7, LOOP_CLR_FD [pid 473] <... close resumed>) = 0 [pid 472] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 479] <... setpgid resumed>) = 0 [pid 474] <... ioctl resumed>) = 0 [pid 473] close(4 [pid 472] <... futex resumed>) = 0 [pid 471] <... clone3 resumed> => {parent_tid=[480]}, 88) = 480 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 479] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 474] close(7 [pid 473] <... close resumed>) = 0 [pid 472] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 471] rt_sigprocmask(SIG_SETMASK, [], [pid 479] <... openat resumed>) = 3 [pid 474] <... close resumed>) = 0 [pid 473] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 470] exit_group(0 [pid 300] newfstatat(AT_FDCWD, "./8/binderfs", [pid 479] write(3, "1000", 4 [pid 474] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 473] <... futex resumed>) = ? [pid 472] <... futex resumed>) = ? [pid 471] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] <... exit_group resumed>) = ? [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 479] <... write resumed>) = 4 [pid 477] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 474] <... futex resumed>) = 0 [pid 473] +++ exited with 0 +++ [pid 472] +++ exited with 0 +++ [pid 471] <... futex resumed>) = 0 [pid 479] close(3 [pid 477] <... futex resumed>) = 1 [pid 474] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 471] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] +++ exited with 0 +++ [pid 469] <... futex resumed>) = 0 [pid 300] unlink("./8/binderfs" [pid 479] <... close resumed>) = 0 [pid 477] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... unlink resumed>) = 0 [pid 479] symlink("/dev/binderfs", "./binderfs" [pid 469] <... futex resumed>) = 0 [pid 300] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=470, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 479] <... symlink resumed>) = 0 [pid 477] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 469] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 479] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 477] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 300] newfstatat(AT_FDCWD, "./8/file0", [pid 297] <... restart_syscall resumed>) = 0 [pid 479] <... futex resumed>) = 0 [pid 479] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 477] <... socket resumed>) = 4 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 480 attached [pid 479] <... rt_sigaction resumed>NULL, 8) = 0 [pid 477] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 480] set_robust_list(0x7f62204449a0, 24 [pid 479] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 477] <... futex resumed>) = 1 [pid 469] <... futex resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 480] <... set_robust_list resumed>) = 0 [pid 479] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 477] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 480] rt_sigprocmask(SIG_SETMASK, [], [pid 479] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 478] rt_sigprocmask(SIG_SETMASK, [], [pid 477] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 469] <... futex resumed>) = 0 [pid 300] <... openat resumed>) = 4 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 480] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 479] <... mmap resumed>) = 0x7f6220445000 [pid 478] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 477] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 476] memfd_create("syzkaller", 0 [pid 469] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] newfstatat(4, "", [pid 297] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 480] creat("./bus", 000 [pid 479] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 477] <... mmap resumed>) = 0x20000000 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 480] <... creat resumed>) = 3 [pid 479] <... mprotect resumed>) = 0 [pid 477] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] getdents64(4, [pid 297] <... openat resumed>) = 3 [pid 480] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] rt_sigprocmask(SIG_BLOCK, ~[], [pid 478] memfd_create("syzkaller", 0 [pid 477] <... futex resumed>) = 1 [pid 476] <... memfd_create resumed>) = 3 [pid 469] <... futex resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 297] newfstatat(3, "", [pid 480] <... futex resumed>) = 1 [pid 479] <... rt_sigprocmask resumed>[], 8) = 0 [pid 477] memfd_create("syzkaller", 0 [pid 471] <... futex resumed>) = 0 [pid 469] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] getdents64(4, [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 480] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 477] <... memfd_create resumed>) = 7 [pid 471] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] <... futex resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 297] getdents64(3, [pid 480] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 477] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 471] <... futex resumed>) = 0 [pid 300] close(4 [pid 480] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 479] <... clone3 resumed> => {parent_tid=[482]}, 88) = 482 [pid 478] <... memfd_create resumed>) = 4 [pid 477] <... mmap resumed>) = 0x7f620fc64000 [pid 476] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 471] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... close resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 128 [pid 480] <... mount resumed>) = 0 [pid 479] rt_sigprocmask(SIG_SETMASK, [], [pid 478] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 477] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 476] <... mmap resumed>) = 0x7f620fc24000 [ 24.581914][ T472] loop1: detected capacity change from 0 to 512 [ 24.602517][ T474] loop5: detected capacity change from 0 to 512 [ 24.609979][ T475] loop0: detected capacity change from 0 to 512 [pid 300] rmdir("./8/file0" [pid 297] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 480] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 480] <... futex resumed>) = 1 [pid 479] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... futex resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 480] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] <... futex resumed>) = 0 [pid 478] <... mmap resumed>) = 0x7f6218024000 [pid 477] <... write resumed>) = 65536 [pid 476] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 471] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 479] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... futex resumed>) = 0 [pid 480] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 479] <... futex resumed>) = 0 [pid 471] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... open resumed>) = 5 [pid 479] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 480] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] <... mmap resumed>) = 0x7f6220424000 [pid 480] <... futex resumed>) = 1 [pid 479] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 471] <... futex resumed>) = 0 [pid 480] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] <... mprotect resumed>) = 0 [pid 471] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 479] rt_sigprocmask(SIG_BLOCK, ~[], [pid 471] <... futex resumed>) = 0 [pid 480] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 479] <... rt_sigprocmask resumed>[], 8) = 0 [pid 471] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 482 attached [pid 480] <... socket resumed>) = 6 [pid 479] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 482] set_robust_list(0x7f62204659a0, 24 [pid 480] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... set_robust_list resumed>) = 0 [pid 480] <... futex resumed>) = 1 [pid 479] <... clone3 resumed> => {parent_tid=[484]}, 88) = 484 [pid 471] <... futex resumed>) = 0 [pid 482] rt_sigprocmask(SIG_SETMASK, [], [pid 480] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] rt_sigprocmask(SIG_SETMASK, [], [pid 471] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 480] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 479] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 471] <... futex resumed>) = 0 [pid 482] memfd_create("syzkaller", 0 [pid 480] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 479] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 482] <... memfd_create resumed>) = 3 [pid 480] <... mmap resumed>) = 0x20000000 [pid 479] <... futex resumed>) = 0 [pid 482] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 480] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 482] <... mmap resumed>) = 0x7f6218024000 [pid 480] <... futex resumed>) = 1 [pid 477] munmap(0x7f620fc64000, 65536 [pid 471] <... futex resumed>) = 0 [pid 300] getdents64(3, [pid 478] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000f02} --- [pid 297] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 477] <... munmap resumed>) = 0 [pid 476] <... write resumed>) = 65536 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 480] +++ killed by SIGBUS +++ [pid 482] <... write resumed>) = 262144 [pid 478] +++ killed by SIGBUS +++ [pid 477] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 471] +++ killed by SIGBUS +++ [pid 300] close(3 [pid 297] newfstatat(AT_FDCWD, "./7/bus", [pid 482] munmap(0x7f6218024000, 262144 [pid 477] <... openat resumed>) = 8 [pid 476] munmap(0x7f620fc24000, 65536 [pid 300] <... close resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 482] <... munmap resumed>) = 0 [pid 477] ioctl(8, LOOP_SET_FD, 7 [pid 476] <... munmap resumed>) = 0 [pid 300] rmdir("./8" [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=471, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 297] unlink("./7/bus" [pid 482] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 477] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 476] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 299] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 484 attached [pid 482] <... openat resumed>) = 4 [pid 477] ioctl(8, LOOP_CLR_FD [pid 476] <... openat resumed>) = 7 [pid 300] <... rmdir resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... unlink resumed>) = 0 [pid 484] set_robust_list(0x7f62204449a0, 24 [pid 482] ioctl(4, LOOP_SET_FD, 3 [pid 477] <... ioctl resumed>) = 0 [pid 476] ioctl(7, LOOP_SET_FD, 3 [pid 300] mkdir("./9", 0777 [pid 299] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 484] <... set_robust_list resumed>) = 0 [pid 476] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 300] <... mkdir resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 484] rt_sigprocmask(SIG_SETMASK, [], [pid 299] newfstatat(3, "", [pid 484] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 484] creat("./bus", 000 [pid 299] getdents64(3, [pid 484] <... creat resumed>) = 5 [pid 299] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 484] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 484] <... futex resumed>) = 1 [pid 479] <... futex resumed>) = 0 [pid 484] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 479] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 484] <... mount resumed>) = 0 [pid 479] <... futex resumed>) = 0 [pid 484] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 484] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 484] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 479] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 479] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 482] <... ioctl resumed>) = 0 [pid 482] close(3) = 0 [pid 482] mkdir("./file0", 0777) = 0 [pid 482] mount("/dev/loop2", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./7/binderfs") = 0 [pid 297] umount2("./7/ext4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./7/ext4", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./7/ext4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./7/ext4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(4, 0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./7/ext4") = 0 [pid 297] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./7") = 0 [pid 297] mkdir("./8", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 476] ioctl(7, LOOP_CLR_FD) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 300] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 300] close(3 [pid 477] ioctl(8, LOOP_SET_FD, 7 [pid 476] ioctl(7, LOOP_SET_FD, 3 [pid 300] <... close resumed>) = 0 [pid 477] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 476] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 477] close(8 [pid 476] close(7 [pid 299] <... umount2 resumed>) = 0 [pid 477] <... close resumed>) = 0 [pid 476] <... close resumed>) = 0 [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 485 [pid 299] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 484] <... open resumed>) = 6 [pid 477] close(7 [pid 476] close(3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 484] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 477] <... close resumed>) = 0 [pid 476] <... close resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./7/bus", [pid 484] <... futex resumed>) = 1 [pid 479] <... futex resumed>) = 0 [pid 477] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 476] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 468] exit_group(0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 484] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 477] <... futex resumed>) = 0 [pid 476] <... futex resumed>) = ? [pid 474] <... futex resumed>) = ? [pid 468] <... exit_group resumed>) = ? [pid 299] unlink("./7/bus" [pid 484] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 479] <... futex resumed>) = 0 [pid 477] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 476] +++ exited with 0 +++ [pid 474] +++ exited with 0 +++ [pid 299] <... unlink resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 484] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 479] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] ioctl(3, LOOP_CLR_FD [pid 484] <... socket resumed>) = 3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 484] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(AT_FDCWD, "./7/binderfs", [pid 297] close(3 [pid 484] <... futex resumed>) = 1 [pid 479] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... close resumed>) = 0 [pid 484] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] unlink("./7/binderfs" [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 485 attached [pid 484] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 479] <... futex resumed>) = 0 [pid 485] set_robust_list(0x555556cc76a0, 24) = 0 [pid 485] chdir("./9") = 0 [pid 485] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 485] setpgid(0, 0) = 0 [ 24.655281][ T481] EXT4-fs warning (device loop0): kmmpd:170: kmmpd being stopped since MMP feature has been disabled. [ 24.661969][ T475] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 24.682744][ T482] loop2: detected capacity change from 0 to 512 [ 24.685957][ T475] EXT4-fs error (device loop0): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # [pid 485] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 485] write(3, "1000", 4) = 4 [pid 485] close(3) = 0 [pid 485] symlink("/dev/binderfs", "./binderfs") = 0 [pid 485] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 485] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 485] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 485] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 485] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 485] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[486]}, 88) = 486 [pid 485] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 485] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 485] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 485] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 485] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[487]}, 88) = 487 [pid 485] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 485] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 485] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... unlink resumed>) = 0 [pid 299] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./7") = 0 [pid 484] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 479] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] mkdir("./8", 0777 [pid 484] <... mmap resumed>) = 0x20000000 [pid 299] <... mkdir resumed>) = 0 [pid 484] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 297] <... clone resumed>, child_tidptr=0x555556cc7690) = 488 [pid 484] <... futex resumed>) = 1 [pid 479] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 ./strace-static-x86_64: Process 487 attached ./strace-static-x86_64: Process 486 attached [pid 484] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 484] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 479] <... futex resumed>) = 0 [pid 486] set_robust_list(0x7f62204659a0, 24 [pid 299] ioctl(3, LOOP_CLR_FD [pid 484] memfd_create("syzkaller", 0 [pid 486] <... set_robust_list resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 486] rt_sigprocmask(SIG_SETMASK, [], [pid 299] close(3 [pid 484] <... memfd_create resumed>) = 7 [pid 486] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 484] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 299] <... close resumed>) = 0 [pid 484] <... mmap resumed>) = 0x7f620fc64000 [pid 486] memfd_create("syzkaller", 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 489 attached ./strace-static-x86_64: Process 488 attached [pid 486] <... memfd_create resumed>) = 3 [pid 484] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 486] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 299] <... clone resumed>, child_tidptr=0x555556cc7690) = 489 [pid 486] <... mmap resumed>) = 0x7f6218024000 [pid 484] <... write resumed>) = 65536 [pid 484] munmap(0x7f620fc64000, 65536 [pid 489] set_robust_list(0x555556cc76a0, 24 [pid 488] set_robust_list(0x555556cc76a0, 24 [pid 486] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 484] <... munmap resumed>) = 0 [pid 486] <... write resumed>) = 262144 [pid 486] munmap(0x7f6218024000, 262144) = 0 [pid 486] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 486] ioctl(4, LOOP_SET_FD, 3 [pid 489] <... set_robust_list resumed>) = 0 [pid 488] <... set_robust_list resumed>) = 0 [pid 487] set_robust_list(0x7f62204449a0, 24 [pid 484] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 489] chdir("./8" [pid 488] chdir("./8" [pid 484] <... openat resumed>) = 8 [pid 484] ioctl(8, LOOP_SET_FD, 7 [pid 488] <... chdir resumed>) = 0 [pid 484] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 489] <... chdir resumed>) = 0 [pid 488] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 484] ioctl(8, LOOP_CLR_FD [pid 489] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 488] <... prctl resumed>) = 0 [pid 484] <... ioctl resumed>) = 0 [pid 489] <... prctl resumed>) = 0 [pid 488] setpgid(0, 0 [pid 489] setpgid(0, 0 [pid 488] <... setpgid resumed>) = 0 [pid 489] <... setpgid resumed>) = 0 [pid 488] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 489] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 488] <... openat resumed>) = 3 [pid 489] <... openat resumed>) = 3 [pid 488] write(3, "1000", 4 [pid 487] <... set_robust_list resumed>) = 0 [pid 489] write(3, "1000", 4 [pid 488] <... write resumed>) = 4 [pid 487] rt_sigprocmask(SIG_SETMASK, [], [pid 484] ioctl(8, LOOP_SET_FD, 7 [pid 489] <... write resumed>) = 4 [pid 488] close(3 [pid 487] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 484] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 489] close(3 [pid 488] <... close resumed>) = 0 [pid 487] creat("./bus", 000 [pid 484] close(8 [pid 489] <... close resumed>) = 0 [pid 486] <... ioctl resumed>) = 0 [pid 486] close(3) = 0 [pid 486] mkdir("./file0", 0777 [pid 484] <... close resumed>) = 0 [pid 484] close(7 [pid 488] symlink("/dev/binderfs", "./binderfs" [pid 489] symlink("/dev/binderfs", "./binderfs" [pid 486] <... mkdir resumed>) = 0 [pid 486] mount("/dev/loop4", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 484] <... close resumed>) = 0 [pid 488] <... symlink resumed>) = 0 [pid 484] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 489] <... symlink resumed>) = 0 [pid 484] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = 0 [pid 489] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 484] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 489] <... futex resumed>) = 0 [pid 488] <... rt_sigaction resumed>NULL, 8) = 0 [pid 489] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 488] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 487] <... creat resumed>) = 3 [pid 487] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 485] <... futex resumed>) = 0 [pid 488] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 489] <... rt_sigaction resumed>NULL, 8) = 0 [pid 487] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 485] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 489] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 487] <... mount resumed>) = 0 [pid 485] <... futex resumed>) = 0 [pid 488] <... mmap resumed>) = 0x7f6220445000 [pid 487] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 489] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 488] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 487] <... futex resumed>) = 0 [pid 485] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 488] <... mprotect resumed>) = 0 [pid 487] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 485] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 489] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 487] <... open resumed>) = 5 [pid 485] <... futex resumed>) = 0 [pid 489] <... mmap resumed>) = 0x7f6220445000 [pid 488] rt_sigprocmask(SIG_BLOCK, ~[], [pid 487] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 489] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 488] <... rt_sigprocmask resumed>[], 8) = 0 [pid 487] <... futex resumed>) = 0 [pid 485] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 489] <... mprotect resumed>) = 0 [pid 488] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 487] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 485] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 487] <... socket resumed>) = 6 [pid 485] <... futex resumed>) = 0 [pid 487] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 487] <... futex resumed>) = 0 [pid 489] rt_sigprocmask(SIG_BLOCK, ~[], [pid 485] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 489] <... rt_sigprocmask resumed>[], 8) = 0 [pid 488] <... clone3 resumed> => {parent_tid=[490]}, 88) = 490 [pid 487] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 485] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 489] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 488] rt_sigprocmask(SIG_SETMASK, [], [pid 487] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 485] <... futex resumed>) = 0 [pid 488] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 487] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 485] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 487] <... mmap resumed>) = 0x20000000 [pid 487] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 485] <... futex resumed>) = 0 [pid 487] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 485] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 487] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 485] <... futex resumed>) = 0 ./strace-static-x86_64: Process 491 attached ./strace-static-x86_64: Process 490 attached [pid 489] <... clone3 resumed> => {parent_tid=[491]}, 88) = 491 [pid 488] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 475] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 468] +++ exited with 0 +++ [pid 491] set_robust_list(0x7f62204659a0, 24 [pid 490] set_robust_list(0x7f62204659a0, 24 [pid 489] rt_sigprocmask(SIG_SETMASK, [], [pid 488] <... futex resumed>) = 0 [pid 487] memfd_create("syzkaller", 0 [pid 482] ioctl(4, LOOP_CLR_FD [pid 475] ioctl(5, LOOP_CLR_FD [pid 491] <... set_robust_list resumed>) = 0 [pid 490] <... set_robust_list resumed>) = 0 [pid 489] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 488] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... ioctl resumed>) = 0 [pid 475] <... ioctl resumed>) = 0 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=468, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 491] rt_sigprocmask(SIG_SETMASK, [], [pid 490] rt_sigprocmask(SIG_SETMASK, [], [pid 489] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = 0 [pid 487] <... memfd_create resumed>) = 7 [pid 482] close(4 [pid 475] close(5 [pid 301] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 491] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 490] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 489] <... futex resumed>) = 0 [pid 488] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 482] <... close resumed>) = 0 [pid 475] <... close resumed>) = 0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 491] memfd_create("syzkaller", 0 [pid 490] memfd_create("syzkaller", 0 [pid 489] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... mmap resumed>) = 0x7f6220424000 [pid 482] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 475] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 491] <... memfd_create resumed>) = 3 [pid 490] <... memfd_create resumed>) = 3 [pid 489] <... futex resumed>) = 0 [pid 488] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 482] <... futex resumed>) = 0 [pid 475] <... futex resumed>) = 0 [pid 301] <... openat resumed>) = 3 [pid 491] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 490] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 489] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 488] <... mprotect resumed>) = 0 [ 24.711871][ T475] EXT4-fs (loop0): get orphan inode failed [ 24.721932][ T475] EXT4-fs (loop0): mount failed [ 24.723979][ T486] loop4: detected capacity change from 0 to 512 [ 24.738727][ T482] EXT4-fs warning (device loop2): read_mmp_block:115: Error -74 while reading MMP block 12 [pid 482] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] exit_group(0 [pid 475] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] exit_group(0 [pid 301] newfstatat(3, "", [pid 491] <... mmap resumed>) = 0x7f6218045000 [pid 490] <... mmap resumed>) = 0x7f6218024000 [pid 489] <... mmap resumed>) = 0x7f6218024000 [pid 488] rt_sigprocmask(SIG_BLOCK, ~[], [pid 487] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 484] <... futex resumed>) = ? [pid 482] <... futex resumed>) = ? [pid 479] <... exit_group resumed>) = ? [pid 477] <... futex resumed>) = ? [pid 475] <... futex resumed>) = ? [pid 469] <... exit_group resumed>) = ? [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 491] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 490] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 489] mprotect(0x7f6218025000, 131072, PROT_READ|PROT_WRITE [pid 488] <... rt_sigprocmask resumed>[], 8) = 0 [pid 487] <... mmap resumed>) = 0x7f620fc64000 [pid 484] +++ exited with 0 +++ [pid 482] +++ exited with 0 +++ [pid 477] +++ exited with 0 +++ [pid 475] +++ exited with 0 +++ [pid 301] getdents64(3, [pid 491] <... write resumed>) = 262144 [pid 490] <... write resumed>) = 262144 [pid 489] <... mprotect resumed>) = 0 [pid 488] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 301] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 128 [pid 491] munmap(0x7f6218045000, 262144 [pid 490] munmap(0x7f6218024000, 262144 [pid 489] rt_sigprocmask(SIG_BLOCK, ~[], [pid 301] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 491] <... munmap resumed>) = 0 [pid 490] <... munmap resumed>) = 0 [pid 489] <... rt_sigprocmask resumed>[], 8) = 0 [pid 488] <... clone3 resumed> => {parent_tid=[492]}, 88) = 492 [pid 491] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 490] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 489] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6218044990, parent_tid=0x7f6218044990, exit_signal=0, stack=0x7f6218024000, stack_size=0x20300, tls=0x7f62180446c0} [pid 488] rt_sigprocmask(SIG_SETMASK, [], [pid 491] <... openat resumed>) = 4 [pid 490] <... openat resumed>) = 4 [pid 488] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 492 attached ./strace-static-x86_64: Process 493 attached [pid 491] ioctl(4, LOOP_SET_FD, 3 [pid 490] ioctl(4, LOOP_SET_FD, 3 [pid 489] <... clone3 resumed> => {parent_tid=[493]}, 88) = 493 [pid 488] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 487] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 301] <... umount2 resumed>) = 0 [pid 487] <... write resumed>) = 65536 [pid 486] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 493] set_robust_list(0x7f62180449a0, 24 [pid 492] set_robust_list(0x7f62204449a0, 24 [pid 487] munmap(0x7f620fc64000, 65536 [pid 493] <... set_robust_list resumed>) = 0 [pid 492] <... set_robust_list resumed>) = 0 [pid 487] <... munmap resumed>) = 0 [pid 486] ioctl(4, LOOP_CLR_FD [pid 493] rt_sigprocmask(SIG_SETMASK, [], [pid 492] rt_sigprocmask(SIG_SETMASK, [], [pid 487] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 493] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 492] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 487] <... openat resumed>) = 8 [pid 486] <... ioctl resumed>) = 0 [pid 493] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 492] creat("./bus", 000 [pid 487] ioctl(8, LOOP_SET_FD, 7 [pid 486] close(4 [pid 492] <... creat resumed>) = 5 [pid 487] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 492] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 487] ioctl(8, LOOP_CLR_FD [pid 486] <... close resumed>) = 0 [pid 492] <... futex resumed>) = 0 [pid 487] <... ioctl resumed>) = 0 [pid 492] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 486] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 486] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 491] <... ioctl resumed>) = 0 [pid 489] rt_sigprocmask(SIG_SETMASK, [], [pid 488] <... futex resumed>) = 1 [pid 301] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 491] close(3 [pid 489] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 488] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 487] ioctl(8, LOOP_SET_FD, 7 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 491] <... close resumed>) = 0 [pid 489] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 487] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 301] newfstatat(AT_FDCWD, "./7/bus", [pid 491] mkdir("./file0", 0777 [pid 489] <... futex resumed>) = 1 [pid 488] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 487] close(8 [pid 301] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 491] <... mkdir resumed>) = 0 [pid 489] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 488] <... futex resumed>) = 0 [pid 487] <... close resumed>) = 0 [pid 301] unlink("./7/bus" [pid 491] mount("/dev/loop3", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 488] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 487] close(7 [pid 301] <... unlink resumed>) = 0 [pid 487] <... close resumed>) = 0 [pid 301] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 487] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 487] <... futex resumed>) = 0 [pid 301] newfstatat(AT_FDCWD, "./7/binderfs", [pid 487] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] unlink("./7/binderfs") = 0 [pid 301] umount2("./7/ext4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 301] newfstatat(AT_FDCWD, "./7/ext4", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] umount2("./7/ext4", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 485] exit_group(0 [pid 301] openat(AT_FDCWD, "./7/ext4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 487] <... futex resumed>) = ? [pid 485] <... exit_group resumed>) = ? [pid 301] <... openat resumed>) = 4 [pid 487] +++ exited with 0 +++ [pid 301] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 301] getdents64(4, 0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 301] getdents64(4, 0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 301] close(4) = 0 [pid 301] rmdir("./7/ext4") = 0 [pid 301] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 301] close(3) = 0 [pid 301] rmdir("./7" [pid 493] <... futex resumed>) = 0 [pid 301] <... rmdir resumed>) = 0 [pid 493] creat("./bus", 000 [pid 486] <... futex resumed>) = ? [pid 301] mkdir("./8", 0777 [pid 493] <... creat resumed>) = 3 [pid 492] <... futex resumed>) = 0 [pid 301] <... mkdir resumed>) = 0 [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 493] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 492] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 301] <... openat resumed>) = 3 [pid 301] ioctl(3, LOOP_CLR_FD [pid 493] <... futex resumed>) = 1 [pid 489] <... futex resumed>) = 0 [pid 301] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 493] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 492] <... mount resumed>) = 0 [pid 489] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] close(3 [pid 489] <... futex resumed>) = 0 [pid 301] <... close resumed>) = 0 [pid 493] <... mount resumed>) = 0 [pid 492] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 489] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 493] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 492] <... futex resumed>) = 1 [pid 490] <... ioctl resumed>) = 0 ./strace-static-x86_64: Process 494 attached [pid 493] <... futex resumed>) = 1 [pid 489] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = 0 [pid 494] set_robust_list(0x555556cc76a0, 24 [pid 493] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 492] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 490] close(3 [pid 489] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... clone resumed>, child_tidptr=0x555556cc7690) = 494 [pid 494] <... set_robust_list resumed>) = 0 [pid 493] <... open resumed>) = 5 [pid 492] <... open resumed>) = 6 [pid 490] <... close resumed>) = 0 [pid 489] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = 0 [pid 494] chdir("./8" [pid 493] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 492] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] mkdir("./file0", 0777 [pid 489] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 488] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 494] <... chdir resumed>) = 0 [pid 493] <... futex resumed>) = 0 [pid 492] <... futex resumed>) = 0 [pid 489] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 493] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 489] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] <... prctl resumed>) = 0 [pid 493] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 492] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 489] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = 0 [pid 494] setpgid(0, 0 [pid 493] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 489] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 488] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 494] <... setpgid resumed>) = 0 [pid 493] <... socket resumed>) = 6 [pid 492] <... socket resumed>) = 3 [pid 494] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 493] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 492] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] <... mkdir resumed>) = 0 [pid 494] <... openat resumed>) = 3 [pid 493] <... futex resumed>) = 1 [pid 492] <... futex resumed>) = 1 [pid 490] mount("/dev/loop1", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 489] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = 0 [pid 494] write(3, "1000", 4 [pid 493] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 492] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 489] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] <... write resumed>) = 4 [pid 493] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 492] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 489] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = 0 [pid 494] close(3 [pid 493] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 492] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 489] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 488] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 494] <... close resumed>) = 0 [pid 493] <... mmap resumed>) = 0x20000000 [pid 492] <... mmap resumed>) = 0x20000000 [pid 479] +++ exited with 0 +++ [pid 469] +++ exited with 0 +++ [pid 494] symlink("/dev/binderfs", "./binderfs" [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=479, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 494] <... symlink resumed>) = 0 [pid 494] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 494] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 494] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 494] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 298] <... openat resumed>) = 3 [pid 494] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] newfstatat(3, "", [pid 494] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 494] <... mmap resumed>) = 0x7f6220445000 [pid 298] getdents64(3, [pid 494] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 298] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 494] <... mprotect resumed>) = 0 [pid 298] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 494] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 493] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = 0 [pid 494] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 298] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 494] <... clone3 resumed> => {parent_tid=[495]}, 88) = 495 [pid 298] newfstatat(AT_FDCWD, "./6/bus", [pid 494] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 494] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] unlink("./6/bus" [pid 494] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... unlink resumed>) = 0 [pid 494] <... futex resumed>) = 0 [pid 298] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 494] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 494] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./6/binderfs", [pid 494] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 494] <... mmap resumed>) = 0x7f6220424000 [pid 298] unlink("./6/binderfs" [pid 494] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 298] <... unlink resumed>) = 0 [pid 494] <... mprotect resumed>) = 0 [pid 298] umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 494] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 494] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] newfstatat(AT_FDCWD, "./6/file0", [pid 494] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 494] <... clone3 resumed> => {parent_tid=[496]}, 88) = 496 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 494] rt_sigprocmask(SIG_SETMASK, [], [pid 298] openat(AT_FDCWD, "./6/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 494] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... openat resumed>) = 4 [pid 494] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(4, "", [pid 494] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 494] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 493] <... futex resumed>) = 1 [pid 489] <... futex resumed>) = 0 [pid 298] getdents64(4, [pid 489] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 489] <... futex resumed>) = 0 [pid 298] getdents64(4, [pid 493] memfd_create("syzkaller", 0 [pid 492] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=469, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 298] close(4 [pid 493] <... memfd_create resumed>) = 7 [pid 492] <... futex resumed>) = 1 [pid 488] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 493] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 488] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] rmdir("./6/file0" [pid 493] <... mmap resumed>) = 0x7f620fc24000 [pid 492] memfd_create("syzkaller", 0 [pid 488] <... futex resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 298] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./6" [pid 493] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 492] <... memfd_create resumed>) = 7 [pid 298] <... rmdir resumed>) = 0 [pid 296] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] mkdir("./7", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 492] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... close resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 493] <... write resumed>) = 65536 [pid 492] <... mmap resumed>) = 0x7f620fc64000 [pid 296] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 498 ./strace-static-x86_64: Process 496 attached ./strace-static-x86_64: Process 495 attached [pid 492] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 493] munmap(0x7f620fc24000, 65536 [pid 296] <... openat resumed>) = 3 [pid 496] set_robust_list(0x7f62204449a0, 24 [pid 492] <... write resumed>) = 65536 [pid 296] newfstatat(3, "", [pid 493] <... munmap resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 492] munmap(0x7f620fc64000, 65536 [pid 493] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] getdents64(3, [pid 495] set_robust_list(0x7f62204659a0, 24 [pid 492] <... munmap resumed>) = 0 [pid 496] <... set_robust_list resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 493] <... openat resumed>) = 8 [pid 492] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 296] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 495] <... set_robust_list resumed>) = 0 [pid 496] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... umount2 resumed>) = 0 [pid 493] ioctl(8, LOOP_SET_FD, 7 [pid 496] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 495] rt_sigprocmask(SIG_SETMASK, [], [pid 492] <... openat resumed>) = 8 [pid 296] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 496] creat("./bus", 000 [pid 495] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 496] <... creat resumed>) = 3 [pid 495] memfd_create("syzkaller", 0 [pid 493] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 492] ioctl(8, LOOP_SET_FD, 7 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 496] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... memfd_create resumed>) = 4 [pid 493] ioctl(8, LOOP_CLR_FD [pid 492] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 296] newfstatat(AT_FDCWD, "./6/bus", [pid 496] <... futex resumed>) = 1 [pid 495] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 494] <... futex resumed>) = 0 [pid 493] <... ioctl resumed>) = 0 [pid 492] ioctl(8, LOOP_CLR_FD [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 496] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 495] <... mmap resumed>) = 0x7f6218024000 [pid 494] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 492] <... ioctl resumed>) = 0 [pid 296] unlink("./6/bus" [pid 496] <... mount resumed>) = 0 [pid 495] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 265740 [pid 494] <... futex resumed>) = 0 [pid 496] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... unlink resumed>) = 0 [pid 496] <... futex resumed>) = 0 [pid 494] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 498 attached [pid 496] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 494] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 498] set_robust_list(0x555556cc76a0, 24 [pid 496] <... open resumed>) = 5 [pid 494] <... futex resumed>) = 0 [pid 498] <... set_robust_list resumed>) = 0 [pid 496] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] newfstatat(AT_FDCWD, "./6/binderfs", [pid 498] chdir("./7" [pid 496] <... futex resumed>) = 0 [pid 494] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 493] ioctl(8, LOOP_SET_FD, 7 [pid 498] <... chdir resumed>) = 0 [pid 496] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [ 24.754307][ T486] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (47122!=0) [ 24.770076][ T486] EXT4-fs (loop4): group descriptors corrupted! [ 24.776774][ T491] loop3: detected capacity change from 0 to 512 [ 24.779586][ T490] loop1: detected capacity change from 0 to 512 [pid 494] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 493] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 492] ioctl(8, LOOP_SET_FD, 7 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 498] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 496] <... socket resumed>) = 6 [pid 495] <... write resumed>) = 265740 [pid 494] <... futex resumed>) = 0 [pid 498] <... prctl resumed>) = 0 [pid 496] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] setpgid(0, 0 [pid 496] <... futex resumed>) = 0 [pid 495] munmap(0x7f6218024000, 265740 [pid 494] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 498] <... setpgid resumed>) = 0 [pid 496] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 495] <... munmap resumed>) = 0 [pid 494] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 498] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 496] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 498] <... openat resumed>) = 3 [pid 496] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 495] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 494] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 498] write(3, "1000", 4 [pid 496] <... mmap resumed>) = 0x20000000 [pid 495] <... openat resumed>) = 7 [pid 498] <... write resumed>) = 4 [pid 496] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] ioctl(7, LOOP_SET_FD, 4 [pid 498] close(3 [pid 496] <... futex resumed>) = 1 [pid 494] <... futex resumed>) = 0 [pid 493] close(8 [pid 492] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 296] unlink("./6/binderfs" [pid 498] <... close resumed>) = 0 [pid 496] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 498] symlink("/dev/binderfs", "./binderfs" [pid 496] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 498] <... symlink resumed>) = 0 [pid 493] <... close resumed>) = 0 [pid 492] close(8 [pid 486] +++ exited with 0 +++ [pid 485] +++ exited with 0 +++ [pid 296] <... unlink resumed>) = 0 [pid 498] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=485, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 498] <... futex resumed>) = 0 [pid 492] <... close resumed>) = 0 [pid 493] close(7 [pid 498] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 492] close(7 [pid 296] umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 498] <... rt_sigaction resumed>NULL, 8) = 0 [pid 300] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 498] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 498] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 498] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] <... openat resumed>) = 3 [pid 498] <... mmap resumed>) = 0x7f6220445000 [pid 493] <... close resumed>) = 0 [pid 492] <... close resumed>) = 0 [pid 300] newfstatat(3, "", [pid 498] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 498] <... mprotect resumed>) = 0 [pid 493] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 492] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] getdents64(3, [pid 498] rt_sigprocmask(SIG_BLOCK, ~[], [pid 493] <... futex resumed>) = 0 [pid 492] <... futex resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 296] newfstatat(AT_FDCWD, "./6/file0", [pid 498] <... rt_sigprocmask resumed>[], 8) = 0 [pid 493] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 492] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 498] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 300] <... umount2 resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 498] <... clone3 resumed> => {parent_tid=[500]}, 88) = 500 [pid 498] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 498] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 498] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 498] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 498] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 490] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 300] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./6/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 498] <... mprotect resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 498] rt_sigprocmask(SIG_BLOCK, ~[], [pid 490] ioctl(4, LOOP_CLR_FD [pid 300] newfstatat(AT_FDCWD, "./9/bus", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 498] <... rt_sigprocmask resumed>[], 8) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] openat(AT_FDCWD, "./6/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 498] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 490] <... ioctl resumed>) = 0 [ 24.813219][ T490] EXT4-fs warning (device loop1): read_mmp_block:115: Error -74 while reading MMP block 12 [ 24.815635][ T495] loop5: detected capacity change from 0 to 519 [ 24.829203][ T497] EXT4-fs warning (device loop3): kmmpd:170: kmmpd being stopped since MMP feature has been disabled. [ 24.830711][ T496] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 31 prio class 0 [ 24.854593][ T491] EXT4-fs (loop3): revision level too high, forcing read-only mode [pid 300] unlink("./9/bus" [pid 296] <... openat resumed>) = 4 [pid 498] <... clone3 resumed> => {parent_tid=[501]}, 88) = 501 [pid 490] close(4 [pid 300] <... unlink resumed>) = 0 [pid 296] newfstatat(4, "", [pid 300] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] getdents64(4, [pid 300] newfstatat(AT_FDCWD, "./9/binderfs", [pid 296] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 490] <... close resumed>) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] getdents64(4, [pid 300] unlink("./9/binderfs" [pid 296] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 300] <... unlink resumed>) = 0 [pid 296] close(4 [pid 300] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... close resumed>) = 0 ./strace-static-x86_64: Process 501 attached ./strace-static-x86_64: Process 500 attached [pid 498] rt_sigprocmask(SIG_SETMASK, [], [pid 490] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] rmdir("./6/file0" [pid 490] <... futex resumed>) = 0 [pid 300] newfstatat(AT_FDCWD, "./9/file0", [pid 296] <... rmdir resumed>) = 0 [pid 490] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] getdents64(3, [pid 300] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] close(3 [pid 300] openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... close resumed>) = 0 [pid 300] <... openat resumed>) = 4 [pid 296] rmdir("./6" [pid 300] newfstatat(4, "", [pid 296] <... rmdir resumed>) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] mkdir("./7", 0777 [pid 501] set_robust_list(0x7f62204449a0, 24 [pid 500] set_robust_list(0x7f62204659a0, 24 [pid 498] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 488] exit_group(0 [pid 300] getdents64(4, [pid 296] <... mkdir resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 300] getdents64(4, [pid 296] <... openat resumed>) = 3 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 300] close(4 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] <... close resumed>) = 0 [pid 296] close(3 [pid 300] rmdir("./9/file0" [pid 296] <... close resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [ 24.865960][ T491] EXT4-fs error (device loop3): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # [ 24.880462][ T491] EXT4-fs (loop3): get orphan inode failed [ 24.880487][ T496] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 24.886440][ T491] EXT4-fs (loop3): mount failed [ 24.897086][ T496] Buffer I/O error on dev loop5, logical block 0, async page read [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556cc7690) = 502 [pid 300] close(3) = 0 [pid 300] rmdir("./9") = 0 [pid 300] mkdir("./10", 0777) = 0 [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 501] <... set_robust_list resumed>) = 0 [pid 500] <... set_robust_list resumed>) = 0 [pid 498] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 492] <... futex resumed>) = ? [pid 490] <... futex resumed>) = ? [pid 488] <... exit_group resumed>) = ? [pid 300] ioctl(3, LOOP_CLR_FD [pid 492] +++ exited with 0 +++ [pid 490] +++ exited with 0 +++ [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] close(3) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 503 ./strace-static-x86_64: Process 502 attached [pid 502] set_robust_list(0x555556cc76a0, 24) = 0 [pid 502] chdir("./7") = 0 [pid 502] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 502] setpgid(0, 0) = 0 [pid 502] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 502] write(3, "1000", 4) = 4 ./strace-static-x86_64: Process 503 attached [pid 501] rt_sigprocmask(SIG_SETMASK, [], [pid 500] rt_sigprocmask(SIG_SETMASK, [], [pid 498] <... futex resumed>) = 0 [pid 496] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 495] <... ioctl resumed>) = 0 [pid 503] set_robust_list(0x555556cc76a0, 24 [pid 495] +++ killed by SIGBUS +++ [pid 501] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 500] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 503] <... set_robust_list resumed>) = 0 [pid 496] +++ killed by SIGBUS +++ [pid 494] +++ killed by SIGBUS +++ [pid 503] chdir("./10") = 0 [pid 503] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 503] setpgid(0, 0) = 0 [pid 491] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=494, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=8} --- [pid 501] creat("./bus", 000 [pid 500] memfd_create("syzkaller", 0 [pid 498] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 503] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 491] ioctl(4, LOOP_CLR_FD [pid 501] <... creat resumed>) = 3 [pid 503] <... openat resumed>) = 3 [pid 501] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 500] <... memfd_create resumed>) = 4 [pid 491] <... ioctl resumed>) = 0 [pid 501] <... futex resumed>) = 1 [pid 500] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 498] <... futex resumed>) = 0 [pid 503] write(3, "1000", 4 [pid 498] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] close(4 [pid 501] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 500] <... mmap resumed>) = 0x7f6218024000 [pid 498] <... futex resumed>) = 0 [pid 503] <... write resumed>) = 4 [pid 501] <... mount resumed>) = 0 [pid 491] <... close resumed>) = 0 [pid 498] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 503] close(3 [pid 491] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... close resumed>) = 0 [pid 491] <... futex resumed>) = 0 [pid 503] symlink("/dev/binderfs", "./binderfs" [pid 491] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 503] <... symlink resumed>) = 0 [pid 503] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 503] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 503] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 503] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 503] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 503] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[504]}, 88) = 504 [pid 503] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 503] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 503] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 500] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 265747 [pid 501] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... mprotect resumed>) = 0 [pid 489] exit_group(0 [pid 501] <... futex resumed>) = 1 [pid 498] <... futex resumed>) = 0 [pid 503] rt_sigprocmask(SIG_BLOCK, ~[], [pid 501] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 498] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 493] <... futex resumed>) = ? [pid 491] <... futex resumed>) = ? [pid 489] <... exit_group resumed>) = ? [pid 503] <... rt_sigprocmask resumed>[], 8) = 0 [pid 498] <... futex resumed>) = 0 [pid 493] +++ exited with 0 +++ [pid 491] +++ exited with 0 +++ [pid 301] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 503] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[505]}, 88) = 505 [pid 503] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 503] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 505 attached [pid 505] set_robust_list(0x7f62204449a0, 24) = 0 [pid 505] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 498] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 501] <... open resumed>) = 5 [pid 505] creat("./bus", 000 [pid 301] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 501] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... openat resumed>) = 3 [pid 501] <... futex resumed>) = 1 [pid 498] <... futex resumed>) = 0 [pid 501] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 498] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] newfstatat(3, "", [pid 498] <... futex resumed>) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 501] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 498] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 501] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 301] getdents64(3, [pid 505] <... creat resumed>) = 3 [pid 505] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 505] <... futex resumed>) = 1 [pid 505] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 505] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 505] <... futex resumed>) = 1 [pid 505] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 505] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 505] <... futex resumed>) = 1 [pid 505] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE) = 5 [pid 505] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 503] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 505] <... futex resumed>) = 1 [pid 505] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0 [pid 501] <... socket resumed>) = 6 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 501] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... mmap resumed>) = 0x20000000 [pid 505] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = 0 [pid 503] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 505] <... futex resumed>) = 1 [pid 505] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 500] <... write resumed>) = 265747 [pid 501] <... futex resumed>) = 1 [pid 301] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 501] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 500] munmap(0x7f6218024000, 265747 [pid 498] <... futex resumed>) = 0 [pid 301] <... umount2 resumed>) = 0 [pid 498] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 501] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 498] <... futex resumed>) = 0 [pid 501] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 498] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 502] close(3 [pid 501] <... mmap resumed>) = 0x20000000 [pid 500] <... munmap resumed>) = 0 [pid 301] newfstatat(AT_FDCWD, "./8/bus", [pid 501] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 501] <... futex resumed>) = 1 [pid 500] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 498] <... futex resumed>) = 0 [pid 301] unlink("./8/bus" [pid 501] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 498] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 504 attached [pid 301] <... unlink resumed>) = 0 [pid 501] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 498] <... futex resumed>) = 0 [pid 301] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 501] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 500] <... openat resumed>) = 7 [pid 498] ????() = ? [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 505] +++ killed by SIGBUS +++ [pid 301] newfstatat(AT_FDCWD, "./8/binderfs", [pid 500] +++ killed by SIGBUS +++ [pid 504] +++ killed by SIGBUS +++ [pid 503] +++ killed by SIGBUS +++ [pid 301] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 502] <... close resumed>) = 0 [pid 501] +++ killed by SIGBUS +++ [pid 498] +++ killed by SIGBUS +++ [pid 301] unlink("./8/binderfs" [pid 502] symlink("/dev/binderfs", "./binderfs" [pid 301] <... unlink resumed>) = 0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=503, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=498, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 301] getdents64(3, [pid 502] <... symlink resumed>) = 0 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 300] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 301] close(3 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 301] <... close resumed>) = 0 [pid 300] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 301] rmdir("./8" [pid 300] <... openat resumed>) = 3 [pid 300] newfstatat(3, "", [pid 298] <... openat resumed>) = 3 [pid 502] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... rmdir resumed>) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] newfstatat(3, "", [pid 301] mkdir("./9", 0777 [pid 300] getdents64(3, [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 502] <... futex resumed>) = 0 [pid 502] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 502] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 502] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 301] <... mkdir resumed>) = 0 [pid 502] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 300] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 300] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(3, [pid 502] <... mprotect resumed>) = 0 [pid 502] rt_sigprocmask(SIG_BLOCK, ~[], [pid 300] <... umount2 resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 300] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 502] <... rt_sigprocmask resumed>[], 8) = 0 [pid 300] newfstatat(AT_FDCWD, "./10/bus", [pid 298] <... umount2 resumed>) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] unlink("./10/bus" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 502] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 300] <... unlink resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./7/bus", [pid 300] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 502] <... clone3 resumed> => {parent_tid=[506]}, 88) = 506 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] unlink("./7/bus" [pid 502] rt_sigprocmask(SIG_SETMASK, [], [pid 300] newfstatat(AT_FDCWD, "./10/binderfs", [pid 298] <... unlink resumed>) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] unlink("./10/binderfs" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 502] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 502] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... unlink resumed>) = 0 [pid 300] getdents64(3, [pid 298] newfstatat(AT_FDCWD, "./7/binderfs", [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] close(3 [pid 502] <... futex resumed>) = 0 [pid 298] unlink("./7/binderfs" [pid 300] <... close resumed>) = 0 [pid 502] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] rmdir("./10" [pid 298] <... unlink resumed>) = 0 [pid 502] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 502] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 502] rt_sigprocmask(SIG_BLOCK, ~[], [pid 300] <... rmdir resumed>) = 0 [pid 298] getdents64(3, [pid 300] mkdir("./11", 0777 [pid 298] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 502] <... rt_sigprocmask resumed>[], 8) = 0 [pid 502] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[507]}, 88) = 507 [pid 502] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 300] <... mkdir resumed>) = 0 [pid 298] close(3 [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 298] <... close resumed>) = 0 [pid 300] <... openat resumed>) = 3 [pid 298] rmdir("./7" [pid 300] ioctl(3, LOOP_CLR_FD [pid 502] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 502] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 507 attached [pid 507] set_robust_list(0x7f62204449a0, 24 [pid 298] <... rmdir resumed>) = 0 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] mkdir("./8", 0777 [pid 300] close(3 [pid 507] <... set_robust_list resumed>) = 0 [pid 507] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 507] creat("./bus", 000 [pid 298] <... mkdir resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... openat resumed>) = 3 [pid 507] <... creat resumed>) = 3 [pid 507] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 502] <... futex resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 508 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 502] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 502] <... futex resumed>) = 0 [pid 502] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 507] <... futex resumed>) = 1 [pid 507] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 507] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 509 [pid 502] <... futex resumed>) = 0 [pid 502] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 502] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] <... futex resumed>) = 1 [pid 507] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c./strace-static-x86_64: Process 508 attached ./strace-static-x86_64: Process 506 attached ) = 4 [pid 507] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 502] <... futex resumed>) = 0 [pid 502] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 508] set_robust_list(0x555556cc76a0, 24 [pid 506] set_robust_list(0x7f62204659a0, 24 [pid 502] <... futex resumed>) = 0 [pid 488] +++ exited with 0 +++ [pid 502] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] <... futex resumed>) = 1 [pid 507] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE) = 5 [pid 507] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 502] <... futex resumed>) = 0 [pid 502] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 502] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 507] <... futex resumed>) = 1 [pid 507] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0) = 0x20000000 [pid 508] <... set_robust_list resumed>) = 0 [pid 506] <... set_robust_list resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=488, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 507] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 502] <... futex resumed>) = 0 [pid 502] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 507] <... futex resumed>) = 1 [pid 508] chdir("./11" [pid 506] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 509 attached [pid 509] set_robust_list(0x555556cc76a0, 24 [pid 297] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 509] <... set_robust_list resumed>) = 0 [pid 509] chdir("./8" [pid 508] <... chdir resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 509] <... chdir resumed>) = 0 [pid 509] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 509] setpgid(0, 0) = 0 [pid 508] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 507] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 506] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 509] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 508] <... prctl resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 509] <... openat resumed>) = 3 [pid 509] write(3, "1000", 4) = 4 [pid 509] close(3) = 0 [pid 509] symlink("/dev/binderfs", "./binderfs" [pid 508] setpgid(0, 0 [pid 506] +++ killed by SIGBUS +++ [pid 489] +++ exited with 0 +++ [pid 301] <... openat resumed>) = 3 [pid 297] newfstatat(3, "", [pid 301] ioctl(3, LOOP_CLR_FD) = 0 [pid 301] close(3 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 301] <... close resumed>) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=489, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] getdents64(3, [pid 299] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 301] <... clone resumed>, child_tidptr=0x555556cc7690) = 510 [pid 299] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 508] <... setpgid resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 297] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 299] getdents64(3, [pid 297] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] newfstatat(AT_FDCWD, "./8/bus", [pid 508] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] <... umount2 resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] unlink("./8/bus" [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./8/bus", [pid 297] <... unlink resumed>) = 0 [pid 508] <... openat resumed>) = 3 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 508] write(3, "1000", 4 [pid 299] unlink("./8/bus" [pid 297] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 508] <... write resumed>) = 4 ./strace-static-x86_64: Process 510 attached [pid 508] close(3 [pid 507] +++ killed by SIGBUS +++ [pid 502] +++ killed by SIGBUS +++ [pid 299] <... unlink resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 508] <... close resumed>) = 0 [pid 299] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] newfstatat(AT_FDCWD, "./8/binderfs", [pid 510] set_robust_list(0x555556cc76a0, 24 [pid 508] symlink("/dev/binderfs", "./binderfs" [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=502, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 510] <... set_robust_list resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./8/binderfs", [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 510] chdir("./9" [pid 508] <... symlink resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./8/binderfs" [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 510] <... chdir resumed>) = 0 [pid 508] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] unlink("./8/binderfs" [pid 297] <... unlink resumed>) = 0 [pid 296] <... restart_syscall resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 510] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 508] <... futex resumed>) = 0 [pid 299] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 510] <... prctl resumed>) = 0 [pid 508] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 510] setpgid(0, 0 [pid 508] <... rt_sigaction resumed>NULL, 8) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./8/file0", [pid 296] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 510] <... setpgid resumed>) = 0 [pid 508] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] newfstatat(AT_FDCWD, "./8/file0", [pid 508] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 508] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 508] <... mmap resumed>) = 0x7f6220445000 [pid 299] openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 510] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 508] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 299] <... openat resumed>) = 4 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 508] <... mprotect resumed>) = 0 [pid 299] newfstatat(4, "", [pid 297] openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... openat resumed>) = 3 [pid 508] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... openat resumed>) = 4 [pid 296] newfstatat(3, "", [pid 510] <... openat resumed>) = 3 [pid 508] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] getdents64(4, [pid 297] newfstatat(4, "", [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 508] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 299] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, [pid 509] <... symlink resumed>) = 0 [pid 508] <... clone3 resumed> => {parent_tid=[511]}, 88) = 511 [pid 299] getdents64(4, [pid 297] getdents64(4, [pid 296] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 508] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 297] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 296] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 508] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] close(4 [pid 297] getdents64(4, ./strace-static-x86_64: Process 511 attached [pid 510] write(3, "1000", 4 [pid 508] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 508] <... futex resumed>) = 0 [pid 299] rmdir("./8/file0" [pid 297] close(4 [pid 296] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 508] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [ 24.909661][ T496] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 24.920855][ T496] Buffer I/O error on dev loop5, logical block 0, async page read [pid 509] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 511] set_robust_list(0x7f62204659a0, 24 [pid 510] <... write resumed>) = 4 [pid 508] <... futex resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 508] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] getdents64(3, [pid 297] rmdir("./8/file0" [pid 296] newfstatat(AT_FDCWD, "./7/bus", [pid 508] <... mmap resumed>) = 0x7f6220424000 [pid 299] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 511] <... set_robust_list resumed>) = 0 [pid 510] close(3 [pid 509] <... futex resumed>) = 0 [pid 508] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 299] close(3 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 508] <... mprotect resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 296] unlink("./7/bus" [pid 508] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] getdents64(3, [pid 509] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 296] <... unlink resumed>) = 0 [pid 508] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] rmdir("./8" [pid 296] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 508] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 297] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 509] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 509] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 299] <... rmdir resumed>) = 0 [pid 509] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 297] close(3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 508] <... clone3 resumed> => {parent_tid=[512]}, 88) = 512 [pid 299] mkdir("./9", 0777 [pid 508] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... close resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./7/binderfs", [pid 509] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 509] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 299] <... mkdir resumed>) = 0 [pid 508] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] rmdir("./8" [pid 508] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] unlink("./7/binderfs" [pid 511] rt_sigprocmask(SIG_SETMASK, [], [pid 510] <... close resumed>) = 0 [pid 509] <... clone3 resumed> => {parent_tid=[513]}, 88) = 513 [pid 508] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 508] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] mkdir("./9", 0777 [pid 296] getdents64(3, ./strace-static-x86_64: Process 513 attached ./strace-static-x86_64: Process 512 attached [pid 511] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 510] symlink("/dev/binderfs", "./binderfs" [pid 509] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... mkdir resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 513] set_robust_list(0x7f62204659a0, 24 [pid 512] set_robust_list(0x7f62204449a0, 24 [pid 511] memfd_create("syzkaller", 0 [pid 510] <... symlink resumed>) = 0 [pid 509] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] close(3 [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 296] close(3 [pid 513] <... set_robust_list resumed>) = 0 [pid 512] <... set_robust_list resumed>) = 0 [pid 511] <... memfd_create resumed>) = 3 [pid 510] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 513] rt_sigprocmask(SIG_SETMASK, [], [pid 512] rt_sigprocmask(SIG_SETMASK, [], [pid 511] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 510] <... futex resumed>) = 0 [pid 509] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] rmdir("./7" [pid 513] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 512] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 511] <... mmap resumed>) = 0x7f6218024000 [pid 510] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 509] <... futex resumed>) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 514 attached [pid 513] memfd_create("syzkaller", 0 [pid 512] creat("./bus", 000 [pid 510] <... rt_sigaction resumed>NULL, 8) = 0 [pid 509] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... clone resumed>, child_tidptr=0x555556cc7690) = 514 [pid 297] close(3 [pid 296] mkdir("./8", 0777 [pid 514] set_robust_list(0x555556cc76a0, 24 [pid 510] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 513] <... memfd_create resumed>) = 3 [pid 512] <... creat resumed>) = 4 [pid 511] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 509] <... futex resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 514] <... set_robust_list resumed>) = 0 [pid 513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 512] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 511] <... write resumed>) = 262144 [pid 510] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 509] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 514] chdir("./9" [pid 513] <... mmap resumed>) = 0x7f6218045000 [pid 512] <... futex resumed>) = 1 [pid 511] munmap(0x7f6218024000, 262144 [pid 510] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 508] <... futex resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 514] <... chdir resumed>) = 0 [pid 512] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 511] <... munmap resumed>) = 0 [pid 510] <... mmap resumed>) = 0x7f6220445000 [pid 509] <... mmap resumed>) = 0x7f6218024000 [pid 508] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... clone resumed>, child_tidptr=0x555556cc7690) = 515 [pid 296] ioctl(3, LOOP_CLR_FD [pid 514] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 512] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 511] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 510] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 508] <... futex resumed>) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 514] <... prctl resumed>) = 0 [pid 512] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 511] <... openat resumed>) = 5 [pid 510] <... mprotect resumed>) = 0 [pid 509] mprotect(0x7f6218025000, 131072, PROT_READ|PROT_WRITE [pid 508] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] close(3 [pid 514] setpgid(0, 0 [pid 512] <... mount resumed>) = 0 [pid 511] ioctl(5, LOOP_SET_FD, 3 [pid 510] rt_sigprocmask(SIG_BLOCK, ~[], [pid 509] <... mprotect resumed>) = 0 [pid 296] <... close resumed>) = 0 ./strace-static-x86_64: Process 515 attached [pid 514] <... setpgid resumed>) = 0 [pid 513] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 512] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] rt_sigprocmask(SIG_BLOCK, ~[], [pid 515] set_robust_list(0x555556cc76a0, 24 [pid 514] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 513] <... write resumed>) = 262144 [pid 512] <... futex resumed>) = 1 [pid 510] <... rt_sigprocmask resumed>[], 8) = 0 [pid 509] <... rt_sigprocmask resumed>[], 8) = 0 [pid 508] <... futex resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 515] <... set_robust_list resumed>) = 0 [pid 513] munmap(0x7f6218045000, 262144 [pid 512] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 510] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 509] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6218044990, parent_tid=0x7f6218044990, exit_signal=0, stack=0x7f6218024000, stack_size=0x20300, tls=0x7f62180446c0} [pid 508] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] chdir("./9" [pid 514] <... openat resumed>) = 3 [pid 513] <... munmap resumed>) = 0 [pid 512] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 508] <... futex resumed>) = 0 [pid 515] <... chdir resumed>) = 0 [pid 514] write(3, "1000", 4 [pid 513] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 512] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 510] <... clone3 resumed> => {parent_tid=[517]}, 88) = 517 [pid 509] <... clone3 resumed> => {parent_tid=[518]}, 88) = 518 [pid 508] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... clone resumed>, child_tidptr=0x555556cc7690) = 516 [pid 515] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 514] <... write resumed>) = 4 [pid 513] <... openat resumed>) = 4 [pid 510] rt_sigprocmask(SIG_SETMASK, [], [pid 509] rt_sigprocmask(SIG_SETMASK, [], [pid 515] <... prctl resumed>) = 0 [pid 514] close(3 [pid 513] ioctl(4, LOOP_SET_FD, 3 [pid 510] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 509] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 518 attached ./strace-static-x86_64: Process 517 attached ./strace-static-x86_64: Process 516 attached [pid 514] <... close resumed>) = 0 [pid 512] <... open resumed>) = 6 [pid 511] <... ioctl resumed>) = 0 [pid 510] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] set_robust_list(0x7f62180449a0, 24 [pid 517] set_robust_list(0x7f62204659a0, 24 [pid 516] set_robust_list(0x555556cc76a0, 24 [pid 514] symlink("/dev/binderfs", "./binderfs" [pid 512] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 511] close(3 [pid 510] <... futex resumed>) = 0 [pid 518] <... set_robust_list resumed>) = 0 [pid 517] <... set_robust_list resumed>) = 0 [pid 516] <... set_robust_list resumed>) = 0 [pid 514] <... symlink resumed>) = 0 [pid 512] <... futex resumed>) = 1 [pid 511] <... close resumed>) = 0 [pid 510] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 508] <... futex resumed>) = 0 [pid 518] rt_sigprocmask(SIG_SETMASK, [], [pid 517] rt_sigprocmask(SIG_SETMASK, [], [pid 516] chdir("./8" [pid 514] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 512] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 511] mkdir("./file0", 0777 [pid 510] <... futex resumed>) = 0 [pid 508] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 517] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 516] <... chdir resumed>) = 0 [pid 514] <... futex resumed>) = 0 [pid 512] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 511] <... mkdir resumed>) = 0 [pid 510] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 508] <... futex resumed>) = 0 [pid 518] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 517] memfd_create("syzkaller", 0 [pid 516] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 514] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 512] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 511] mount("/dev/loop4", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 510] <... mmap resumed>) = 0x7f6220424000 [pid 509] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 508] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 518] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 517] <... memfd_create resumed>) = 3 [pid 516] <... prctl resumed>) = 0 [pid 515] setpgid(0, 0 [pid 514] <... rt_sigaction resumed>NULL, 8) = 0 [pid 513] <... ioctl resumed>) = 0 [pid 512] <... socket resumed>) = 3 [pid 509] <... futex resumed>) = 0 [pid 518] creat("./bus", 000 [pid 517] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 516] setpgid(0, 0 [pid 515] <... setpgid resumed>) = 0 [pid 514] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 512] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 518] <... creat resumed>) = 5 [pid 517] <... mmap resumed>) = 0x7f6218024000 [pid 516] <... setpgid resumed>) = 0 [pid 515] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 514] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 513] close(3 [pid 512] <... futex resumed>) = 1 [pid 510] <... mprotect resumed>) = 0 [pid 509] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 508] <... futex resumed>) = 0 [pid 515] <... openat resumed>) = 3 [pid 513] <... close resumed>) = 0 [pid 515] write(3, "1000", 4) = 4 [pid 513] mkdir("./file0", 0777 [pid 515] close(3) = 0 [pid 513] <... mkdir resumed>) = 0 [pid 515] symlink("/dev/binderfs", "./binderfs" [pid 517] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 515] <... symlink resumed>) = 0 [pid 514] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 513] mount("/dev/loop2", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 508] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 512] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 516] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 515] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... mmap resumed>) = 0x7f6220445000 [pid 510] rt_sigprocmask(SIG_BLOCK, ~[], [pid 517] <... write resumed>) = 262144 [pid 515] <... futex resumed>) = 0 [pid 508] <... futex resumed>) = 0 [pid 515] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 514] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 512] <... mmap resumed>) = 0x20000000 [pid 510] <... rt_sigprocmask resumed>[], 8) = 0 [pid 516] <... openat resumed>) = 3 [pid 515] <... rt_sigaction resumed>NULL, 8) = 0 [pid 508] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 517] munmap(0x7f6218024000, 262144 [pid 516] write(3, "1000", 4 [pid 515] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 514] <... mprotect resumed>) = 0 [pid 512] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 508] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 515] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 514] rt_sigprocmask(SIG_BLOCK, ~[], [pid 515] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 508] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... mmap resumed>) = 0x7f6220445000 [pid 515] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 516] <... write resumed>) = 4 [pid 515] <... mprotect resumed>) = 0 [pid 514] <... rt_sigprocmask resumed>[], 8) = 0 [pid 512] <... futex resumed>) = 0 [pid 510] <... clone3 resumed> => {parent_tid=[519]}, 88) = 519 [pid 508] <... futex resumed>) = 0 [pid 517] <... munmap resumed>) = 0 [pid 516] close(3 [pid 515] rt_sigprocmask(SIG_BLOCK, ~[], [pid 514] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 512] memfd_create("syzkaller", 0 [pid 517] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 516] <... close resumed>) = 0 [pid 515] <... rt_sigprocmask resumed>[], 8) = 0 [pid 510] rt_sigprocmask(SIG_SETMASK, [], [pid 515] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 512] <... memfd_create resumed>) = 7 [pid 517] <... openat resumed>) = 4 [pid 516] symlink("/dev/binderfs", "./binderfs" [pid 514] <... clone3 resumed> => {parent_tid=[520]}, 88) = 520 [pid 512] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 510] <... rt_sigprocmask resumed>NULL, 8) = 0 ./strace-static-x86_64: Process 520 attached [pid 518] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 517] ioctl(4, LOOP_SET_FD, 3 [pid 516] <... symlink resumed>) = 0 [pid 515] <... clone3 resumed> => {parent_tid=[521]}, 88) = 521 [pid 514] rt_sigprocmask(SIG_SETMASK, [], [pid 512] <... mmap resumed>) = 0x7f620fc64000 [pid 510] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 515] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 515] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 515] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 515] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 516] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 512] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 510] <... futex resumed>) = 0 ./strace-static-x86_64: Process 519 attached [pid 515] <... clone3 resumed> => {parent_tid=[522]}, 88) = 522 [pid 519] set_robust_list(0x7f62204449a0, 24 [pid 515] rt_sigprocmask(SIG_SETMASK, [], [pid 519] <... set_robust_list resumed>) = 0 [pid 515] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 519] rt_sigprocmask(SIG_SETMASK, [], [pid 515] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 515] <... futex resumed>) = 0 [pid 519] creat("./bus", 000 [pid 515] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] <... creat resumed>) = 5 [pid 519] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 522 attached [pid 522] set_robust_list(0x7f62204449a0, 24) = 0 [pid 522] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 522] creat("./bus", 000) = 3 [pid 522] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] <... futex resumed>) = 1 [pid 522] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 ./strace-static-x86_64: Process 521 attached [pid 521] set_robust_list(0x7f62204659a0, 24) = 0 [pid 521] rt_sigprocmask(SIG_SETMASK, [], [pid 522] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 521] memfd_create("syzkaller", 0 [pid 522] <... futex resumed>) = 1 [pid 522] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 521] <... memfd_create resumed>) = 5 [pid 522] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] <... futex resumed>) = 1 [pid 522] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 521] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 522] <... socket resumed>) = 6 [pid 521] <... mmap resumed>) = 0x7f6218024000 [pid 521] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 522] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 515] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 522] <... futex resumed>) = 1 [pid 522] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0) = 0x20000000 [pid 522] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] <... futex resumed>) = 0 [pid 515] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 522] <... futex resumed>) = 1 [pid 522] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 521] <... write resumed>) = ? [pid 522] +++ killed by SIGBUS +++ [pid 521] +++ killed by SIGBUS +++ [pid 520] set_robust_list(0x7f62204659a0, 24 [pid 518] <... futex resumed>) = 1 [pid 517] <... ioctl resumed>) = 0 [pid 516] <... futex resumed>) = 0 [pid 515] +++ killed by SIGBUS +++ [pid 514] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 512] <... write resumed>) = 65536 [pid 510] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 509] <... futex resumed>) = 0 [pid 520] <... set_robust_list resumed>) = 0 [pid 518] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 514] <... futex resumed>) = 0 [pid 512] munmap(0x7f620fc64000, 65536 [pid 511] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 510] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 509] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 520] rt_sigprocmask(SIG_SETMASK, [], [pid 518] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] <... rt_sigaction resumed>NULL, 8) = 0 [pid 514] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 512] <... munmap resumed>) = 0 [pid 510] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=515, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 520] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 518] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 516] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 514] <... futex resumed>) = 0 [pid 512] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 510] <... futex resumed>) = 1 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 520] memfd_create("syzkaller", 0 [pid 518] <... mount resumed>) = 0 [pid 517] close(3 [pid 516] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 514] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 512] <... openat resumed>) = 8 [pid 510] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... restart_syscall resumed>) = 0 [pid 520] <... memfd_create resumed>) = 3 [pid 518] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 517] <... close resumed>) = 0 [pid 516] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 514] <... mmap resumed>) = 0x7f6220424000 [ 25.004859][ T511] loop4: detected capacity change from 0 to 512 [ 25.013565][ T513] loop2: detected capacity change from 0 to 512 [ 25.027757][ T511] EXT4-fs warning (device loop4): read_mmp_block:115: Error -74 while reading MMP block 12 [ 25.028037][ T517] loop5: detected capacity change from 0 to 512 [pid 512] ioctl(8, LOOP_SET_FD, 7 [pid 520] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 518] <... futex resumed>) = 0 [pid 517] mkdir("./file0", 0777 [pid 516] <... mmap resumed>) = 0x7f6220445000 [pid 514] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 512] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 520] <... mmap resumed>) = 0x7f6218024000 [pid 518] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 517] <... mkdir resumed>) = 0 [pid 516] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 514] <... mprotect resumed>) = 0 [pid 512] ioctl(8, LOOP_CLR_FD [pid 297] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 520] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 517] mount("/dev/loop5", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 516] <... mprotect resumed>) = 0 [pid 514] rt_sigprocmask(SIG_BLOCK, ~[], [pid 512] <... ioctl resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 520] <... write resumed>) = 262144 [pid 516] rt_sigprocmask(SIG_BLOCK, ~[], [pid 514] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 520] munmap(0x7f6218024000, 262144 [pid 516] <... rt_sigprocmask resumed>[], 8) = 0 [pid 514] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 297] <... openat resumed>) = 3 [pid 520] <... munmap resumed>) = 0 [pid 516] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 297] newfstatat(3, "", [pid 520] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 514] <... clone3 resumed> => {parent_tid=[525]}, 88) = 525 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 520] <... openat resumed>) = 4 [pid 516] <... clone3 resumed> => {parent_tid=[526]}, 88) = 526 [pid 514] rt_sigprocmask(SIG_SETMASK, [], [pid 512] ioctl(8, LOOP_SET_FD, 7 [pid 297] getdents64(3, ./strace-static-x86_64: Process 526 attached ./strace-static-x86_64: Process 525 attached [pid 520] ioctl(4, LOOP_SET_FD, 3 [pid 519] <... futex resumed>) = 0 [pid 518] <... futex resumed>) = 0 [pid 516] rt_sigprocmask(SIG_SETMASK, [], [pid 514] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 513] <... mount resumed>) = 0 [pid 512] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 511] ioctl(5, LOOP_CLR_FD [pid 509] <... futex resumed>) = 1 [pid 297] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 526] set_robust_list(0x7f62204659a0, 24 [pid 525] set_robust_list(0x7f62204449a0, 24 [pid 519] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 518] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 511] <... ioctl resumed>) = 0 [pid 509] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 519] <... mount resumed>) = 0 [pid 511] close(5 [pid 509] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 526] <... set_robust_list resumed>) = 0 [pid 525] <... set_robust_list resumed>) = 0 [pid 520] <... ioctl resumed>) = 0 [pid 519] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 514] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY [pid 512] close(8 [pid 511] <... close resumed>) = 0 [pid 297] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 526] rt_sigprocmask(SIG_SETMASK, [], [pid 525] rt_sigprocmask(SIG_SETMASK, [], [pid 520] close(3 [pid 519] <... futex resumed>) = 1 [pid 516] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... futex resumed>) = 0 [pid 513] <... openat resumed>) = 3 [pid 512] <... close resumed>) = 0 [pid 511] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] <... futex resumed>) = 0 [pid 509] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = 0 [pid 526] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 525] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 520] <... close resumed>) = 0 [pid 519] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 518] <... futex resumed>) = 0 [pid 516] <... futex resumed>) = 0 [pid 514] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] chdir("./file0" [pid 512] close(7 [pid 511] <... futex resumed>) = 0 [pid 510] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 1 [pid 297] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 526] memfd_create("syzkaller", 0 [pid 525] creat("./bus", 000 [pid 520] mkdir("./file0", 0777 [pid 519] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 518] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 516] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] <... chdir resumed>) = 0 [pid 512] <... close resumed>) = 0 [pid 511] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 510] <... futex resumed>) = 0 [pid 509] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 526] <... memfd_create resumed>) = 3 [pid 525] <... creat resumed>) = 3 [pid 520] <... mkdir resumed>) = 0 [pid 519] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 516] <... futex resumed>) = 0 [pid 513] ioctl(4, LOOP_CLR_FD [pid 512] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 508] exit_group(0 [pid 297] newfstatat(AT_FDCWD, "./9/bus", [pid 526] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 525] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 520] mount("/dev/loop3", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 519] <... open resumed>) = 3 [pid 518] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 516] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 513] <... ioctl resumed>) = 0 [pid 512] <... futex resumed>) = ? [pid 511] <... futex resumed>) = ? [pid 508] <... exit_group resumed>) = ? [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 526] <... mmap resumed>) = 0x7f6218045000 [pid 525] <... futex resumed>) = 1 [pid 519] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] <... mmap resumed>) = 0x7f6218024000 [pid 514] <... futex resumed>) = 0 [pid 513] close(4 [pid 512] +++ exited with 0 +++ [pid 511] +++ exited with 0 +++ [pid 297] unlink("./9/bus" [pid 525] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 519] <... futex resumed>) = 1 [pid 518] <... futex resumed>) = 1 [pid 516] mprotect(0x7f6218025000, 131072, PROT_READ|PROT_WRITE [pid 514] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] <... close resumed>) = 0 [pid 510] <... futex resumed>) = 0 [pid 509] <... futex resumed>) = 0 [pid 525] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 519] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 518] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] <... mprotect resumed>) = 0 [pid 514] <... futex resumed>) = 0 [pid 513] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... unlink resumed>) = 0 [pid 525] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 519] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] rt_sigprocmask(SIG_BLOCK, ~[], [pid 514] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] <... futex resumed>) = 0 [pid 510] <... futex resumed>) = 0 [pid 509] <... futex resumed>) = 0 [pid 297] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 525] <... mount resumed>) = 0 [pid 519] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 516] <... rt_sigprocmask resumed>[], 8) = 0 [pid 513] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 510] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 509] futex(0x7f62205316cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 525] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] <... socket resumed>) = 6 [pid 516] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6218044990, parent_tid=0x7f6218044990, exit_signal=0, stack=0x7f6218024000, stack_size=0x20300, tls=0x7f62180446c0} [pid 513] <... socket resumed>) = 4 [pid 297] newfstatat(AT_FDCWD, "./9/binderfs", [pid 525] <... futex resumed>) = 1 [pid 519] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... futex resumed>) = 0 [pid 513] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] <... futex resumed>) = 1 [pid 516] <... clone3 resumed> => {parent_tid=[528]}, 88) = 528 [pid 513] <... futex resumed>) = 1 [pid 510] <... futex resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 514] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 519] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] rt_sigprocmask(SIG_SETMASK, [], [pid 514] <... futex resumed>) = 0 [pid 513] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 510] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 0 [pid 297] unlink("./9/binderfs" [pid 525] <... open resumed>) = 5 [pid 519] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 514] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] <... futex resumed>) = 0 [pid 509] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 516] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... unlink resumed>) = 0 [pid 525] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 3, 0 [pid 516] <... futex resumed>) = 0 [pid 513] <... futex resumed>) = 0 [pid 510] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 509] <... futex resumed>) = 1 [pid 297] getdents64(3, [pid 525] <... futex resumed>) = 1 [pid 519] <... mmap resumed>) = 0x20000000 [pid 516] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 514] <... futex resumed>) = 0 [pid 513] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, -1, 0 [pid 509] futex(0x7f62205316cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 526] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 525] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 519] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] <... mmap resumed>) = -1 EBADF (Bad file descriptor) [pid 297] close(3 [pid 514] <... futex resumed>) = 0 [pid 513] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] <... futex resumed>) = 1 [pid 510] <... futex resumed>) = 0 [pid 525] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 519] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 514] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] <... futex resumed>) = 1 [pid 510] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] <... futex resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 525] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 519] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 513] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 510] <... futex resumed>) = 0 [pid 509] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] rmdir("./9" [pid 525] <... socket resumed>) = 6 [pid 513] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 509] <... futex resumed>) = 0 [pid 519] memfd_create("syzkaller", 0 [pid 513] memfd_create("syzkaller", 0./strace-static-x86_64: Process 528 attached [pid 528] set_robust_list(0x7f62180449a0, 24) = 0 [pid 528] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 528] creat("./bus", 000 [pid 513] <... memfd_create resumed>) = 6 [pid 525] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] <... memfd_create resumed>) = 7 [pid 513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 297] mkdir("./10", 0777 [pid 525] <... futex resumed>) = 1 [pid 519] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 514] <... futex resumed>) = 0 [pid 513] <... mmap resumed>) = 0x7f620fc24000 [pid 528] <... creat resumed>) = 4 [pid 526] <... write resumed>) = 262144 [pid 525] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 519] <... mmap resumed>) = 0x7f620fc64000 [pid 514] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] write(6, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 297] <... mkdir resumed>) = 0 [pid 519] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 514] <... futex resumed>) = 0 [pid 513] <... write resumed>) = 65536 [pid 519] <... write resumed>) = 65536 [pid 514] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] munmap(0x7f620fc24000, 65536 [pid 519] munmap(0x7f620fc64000, 65536 [pid 513] <... munmap resumed>) = 0 [pid 525] <... mmap resumed>) = 0x20000000 [pid 519] <... munmap resumed>) = 0 [pid 513] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 525] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 519] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 513] <... openat resumed>) = 7 [pid 297] <... openat resumed>) = 3 [pid 525] <... futex resumed>) = 1 [pid 519] <... openat resumed>) = 8 [pid 514] <... futex resumed>) = 0 [pid 513] ioctl(7, LOOP_SET_FD, 6 [pid 297] ioctl(3, LOOP_CLR_FD [pid 525] memfd_create("syzkaller", 0 [pid 519] ioctl(8, LOOP_SET_FD, 7 [pid 514] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 525] <... memfd_create resumed>) = 7 [pid 519] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 514] <... futex resumed>) = 0 [pid 513] ioctl(7, LOOP_CLR_FD [pid 297] close(3 [pid 525] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 519] ioctl(8, LOOP_CLR_FD [pid 513] <... ioctl resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 525] <... mmap resumed>) = 0x7f620fc64000 [pid 519] <... ioctl resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 525] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536) = 65536 [pid 297] <... clone resumed>, child_tidptr=0x555556cc7690) = 529 [pid 525] munmap(0x7f620fc64000, 65536) = 0 [pid 513] ioctl(7, LOOP_SET_FD, 6 [pid 525] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 513] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 525] <... openat resumed>) = 8 [pid 513] close(7 [pid 525] ioctl(8, LOOP_SET_FD, 7 [pid 513] <... close resumed>) = 0 [pid 525] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 513] close(6 [pid 525] ioctl(8, LOOP_CLR_FD [pid 513] <... close resumed>) = 0 [pid 525] <... ioctl resumed>) = 0 [pid 519] ioctl(8, LOOP_SET_FD, 7 [pid 513] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 509] exit_group(0 [pid 519] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 518] <... futex resumed>) = ? [pid 509] <... exit_group resumed>) = ? [pid 519] close(8 [pid 518] +++ exited with 0 +++ [pid 513] <... futex resumed>) = ? [pid 519] <... close resumed>) = 0 [pid 513] +++ exited with 0 +++ [pid 509] +++ exited with 0 +++ [pid 519] close(7 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=509, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 519] <... close resumed>) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 519] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 519] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 526] munmap(0x7f6218045000, 262144 [pid 298] <... restart_syscall resumed>) = 0 [pid 298] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 525] ioctl(8, LOOP_SET_FD, 7 [pid 298] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 525] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 298] <... openat resumed>) = 3 [pid 525] close(8 [pid 298] newfstatat(3, "", [pid 525] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 525] close(7 [pid 298] getdents64(3, [pid 525] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 525] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 525] <... futex resumed>) = 0 [pid 525] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 526] <... munmap resumed>) = 0 [ 25.050043][ T513] EXT4-fs (loop2): mounted filesystem without journal. Opts: nodiscard,barrier,nouid32,grpquota,,errors=continue. Quota mode: writeback. [ 25.064020][ T513] ext4 filesystem being mounted at /root/syzkaller.4RDDfu/8/file0 supports timestamps until 2038 (0x7fffffff) [ 25.076103][ T520] loop3: detected capacity change from 0 to 512 [ 25.092485][ T527] EXT4-fs warning (device loop5): kmmpd:170: kmmpd being stopped since MMP feature has been disabled. [pid 526] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 526] ioctl(5, LOOP_SET_FD, 3./strace-static-x86_64: Process 529 attached [pid 528] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] <... ioctl resumed>) = 0 [pid 520] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 298] <... umount2 resumed>) = 0 [pid 529] set_robust_list(0x555556cc76a0, 24 [pid 528] <... futex resumed>) = 1 [pid 520] ioctl(4, LOOP_CLR_FD [pid 516] <... futex resumed>) = 0 [pid 298] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 529] <... set_robust_list resumed>) = 0 [pid 528] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 520] <... ioctl resumed>) = 0 [pid 516] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 529] chdir("./10" [pid 528] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 520] close(4 [pid 516] <... futex resumed>) = 0 [pid 529] <... chdir resumed>) = 0 [pid 528] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 520] <... close resumed>) = 0 [pid 516] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 529] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 528] <... mount resumed>) = 0 [pid 526] close(3 [pid 520] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] <... prctl resumed>) = 0 [pid 528] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] <... close resumed>) = 0 [pid 520] <... futex resumed>) = 0 [pid 529] setpgid(0, 0 [pid 528] <... futex resumed>) = 1 [pid 526] mkdir("./file0", 0777 [pid 520] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] <... futex resumed>) = 0 [pid 529] <... setpgid resumed>) = 0 [pid 528] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 526] <... mkdir resumed>) = 0 [pid 516] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 528] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 526] mount("/dev/loop0", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 516] <... futex resumed>) = 0 [pid 529] <... openat resumed>) = 3 [pid 528] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 516] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 529] write(3, "1000", 4 [pid 528] <... open resumed>) = 3 [pid 508] +++ exited with 0 +++ [pid 298] newfstatat(AT_FDCWD, "./8/bus", [pid 529] <... write resumed>) = 4 [pid 528] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] close(3 [pid 528] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = 0 [pid 529] <... close resumed>) = 0 [pid 528] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] symlink("/dev/binderfs", "./binderfs" [pid 528] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] <... futex resumed>) = 0 [pid 529] <... symlink resumed>) = 0 [pid 528] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 516] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 529] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 528] <... socket resumed>) = 6 [pid 529] <... futex resumed>) = 0 [pid 528] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 528] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = 0 [pid 529] <... rt_sigaction resumed>NULL, 8) = 0 [pid 528] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 528] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] <... futex resumed>) = 0 [pid 529] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 528] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 3, 0 [pid 516] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 529] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 528] <... mmap resumed>) = 0x20000000 [pid 529] <... mmap resumed>) = 0x7f6220445000 [pid 528] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 528] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = 0 [pid 529] <... mprotect resumed>) = 0 [pid 528] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] rt_sigprocmask(SIG_BLOCK, ~[], [pid 528] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] <... futex resumed>) = 0 [pid 529] <... rt_sigprocmask resumed>[], 8) = 0 [pid 528] memfd_create("syzkaller", 0 [pid 529] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 528] <... memfd_create resumed>) = 7 [pid 528] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 529] <... clone3 resumed> => {parent_tid=[531]}, 88) = 531 [pid 528] <... mmap resumed>) = 0x7f620fc24000 [pid 529] rt_sigprocmask(SIG_SETMASK, [], [pid 528] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 529] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 528] <... write resumed>) = 65536 [pid 529] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 528] munmap(0x7f620fc24000, 65536 [pid 529] <... futex resumed>) = 0 [pid 528] <... munmap resumed>) = 0 [pid 529] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 528] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 529] <... futex resumed>) = 0 [pid 528] <... openat resumed>) = 8 [pid 529] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 528] ioctl(8, LOOP_SET_FD, 7 [pid 529] <... mmap resumed>) = 0x7f6220424000 [pid 528] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 529] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 528] ioctl(8, LOOP_CLR_FD [pid 529] <... mprotect resumed>) = 0 [pid 528] <... ioctl resumed>) = 0 [pid 529] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 529] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[532]}, 88) = 532 [pid 529] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 529] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 529] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 528] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 528] close(8) = 0 [pid 528] close(7) = 0 [pid 528] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 528] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 532 attached ./strace-static-x86_64: Process 531 attached [pid 514] exit_group(0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 25.103591][ T520] EXT4-fs warning (device loop3): read_mmp_block:115: Error -74 while reading MMP block 12 [ 25.106669][ T526] loop0: detected capacity change from 0 to 512 [ 25.120525][ T517] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 25.129466][ T517] EXT4-fs error (device loop5): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # [ 25.145662][ T517] EXT4-fs (loop5): get orphan inode failed [pid 532] set_robust_list(0x7f62204449a0, 24 [pid 531] set_robust_list(0x7f62204659a0, 24 [pid 514] <... exit_group resumed>) = ? [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=508, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 298] unlink("./8/bus" [pid 532] <... set_robust_list resumed>) = 0 [pid 531] <... set_robust_list resumed>) = 0 [pid 525] <... futex resumed>) = ? [pid 520] <... futex resumed>) = ? [pid 300] restart_syscall(<... resuming interrupted clone ...> [pid 298] <... unlink resumed>) = 0 [pid 531] rt_sigprocmask(SIG_SETMASK, [], [pid 520] +++ exited with 0 +++ [pid 531] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] <... restart_syscall resumed>) = 0 [pid 532] rt_sigprocmask(SIG_SETMASK, [], [pid 531] memfd_create("syzkaller", 0 [pid 532] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 532] creat("./bus", 000) = 3 [pid 300] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 531] <... memfd_create resumed>) = 4 [pid 298] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 531] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 531] <... mmap resumed>) = 0x7f6218024000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... openat resumed>) = 3 [pid 532] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 531] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 300] newfstatat(3, "", [pid 298] newfstatat(AT_FDCWD, "./8/binderfs", [pid 532] <... futex resumed>) = 1 [pid 529] <... futex resumed>) = 0 [pid 529] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 532] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 529] <... futex resumed>) = 0 [pid 300] getdents64(3, [pid 298] unlink("./8/binderfs" [pid 532] <... mount resumed>) = 0 [pid 529] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 532] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 298] <... unlink resumed>) = 0 [pid 532] <... futex resumed>) = 1 [pid 529] <... futex resumed>) = 0 [pid 300] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 532] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 529] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] <... umount2 resumed>) = 0 [pid 532] <... open resumed>) = 5 [pid 529] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 532] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 529] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 517] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 517] ioctl(4, LOOP_CLR_FD) = 0 [pid 517] close(4) = 0 [pid 517] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 517] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 529] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 532] <... futex resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 529] <... futex resumed>) = 0 [pid 529] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] exit_group(0 [pid 532] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 300] newfstatat(AT_FDCWD, "./11/bus", [pid 510] <... exit_group resumed>) = ? [pid 532] <... socket resumed>) = 6 [pid 519] <... futex resumed>) = ? [pid 519] +++ exited with 0 +++ [pid 532] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 532] <... futex resumed>) = 1 [pid 529] <... futex resumed>) = 0 [pid 300] unlink("./11/bus" [pid 532] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 529] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... unlink resumed>) = 0 [pid 532] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 529] <... futex resumed>) = 0 [pid 532] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 531] <... write resumed>) = 262144 [pid 529] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = 0 [pid 531] munmap(0x7f6218024000, 262144) = 0 [pid 531] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 7 [pid 531] ioctl(7, LOOP_SET_FD, 4 [pid 532] <... mmap resumed>) = 0x20000000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] newfstatat(AT_FDCWD, "./11/binderfs", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] unlink("./11/binderfs" [pid 298] newfstatat(AT_FDCWD, "./8/file0", [pid 300] <... unlink resumed>) = 0 [pid 532] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 532] <... futex resumed>) = 1 [pid 529] <... futex resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 529] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 529] <... futex resumed>) = 0 [pid 300] newfstatat(AT_FDCWD, "./11/file0", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 517] <... futex resumed>) = ? [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... openat resumed>) = 4 [pid 300] openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] newfstatat(4, "", [pid 531] <... ioctl resumed>) = 0 [pid 525] +++ exited with 0 +++ [pid 514] +++ exited with 0 +++ [pid 300] <... openat resumed>) = 4 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=514, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 300] newfstatat(4, "", [pid 298] getdents64(4, [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 300] getdents64(4, [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] getdents64(4, [pid 300] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 299] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 300] getdents64(4, [pid 299] <... openat resumed>) = 3 [pid 298] close(4 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 299] newfstatat(3, "", [pid 298] <... close resumed>) = 0 [pid 300] close(4 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] rmdir("./8/file0" [pid 300] <... close resumed>) = 0 [pid 532] memfd_create("syzkaller", 0 [pid 300] rmdir("./11/file0" [pid 299] getdents64(3, [pid 298] <... rmdir resumed>) = 0 [pid 532] <... memfd_create resumed>) = 8 [pid 300] <... rmdir resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 298] getdents64(3, [pid 532] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 300] getdents64(3, [pid 299] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 532] <... mmap resumed>) = 0x7f620fc64000 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 298] close(3 [pid 532] write(8, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 300] close(3 [pid 298] <... close resumed>) = 0 [pid 532] <... write resumed>) = 65536 [pid 300] <... close resumed>) = 0 [pid 298] rmdir("./8" [pid 532] munmap(0x7f620fc64000, 65536 [pid 300] rmdir("./11" [pid 298] <... rmdir resumed>) = 0 [pid 532] <... munmap resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 298] mkdir("./9", 0777 [pid 532] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 300] mkdir("./12", 0777 [pid 298] <... mkdir resumed>) = 0 [pid 300] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 298] <... openat resumed>) = 3 [pid 300] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD [pid 300] ioctl(3, LOOP_CLR_FD [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 300] close(3 [pid 298] <... close resumed>) = 0 [pid 300] <... close resumed>) = 0 [ 25.153249][ T517] EXT4-fs (loop5): mount failed [ 25.169859][ T531] loop1: detected capacity change from 0 to 512 [ 25.179279][ T526] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodiscard,barrier,nouid32,grpquota,,errors=continue. Quota mode: writeback. [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 535 [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 536 ./strace-static-x86_64: Process 536 attached ./strace-static-x86_64: Process 535 attached [pid 531] close(4 [pid 526] <... mount resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 535] set_robust_list(0x555556cc76a0, 24 [pid 531] <... close resumed>) = 0 [pid 526] openat(AT_FDCWD, 0x20000000, O_RDONLY|O_DIRECTORY [pid 535] <... set_robust_list resumed>) = 0 [pid 531] mkdir(0x20000000, 0777 [pid 526] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 535] chdir("./9" [pid 531] <... mkdir resumed>) = 0 [pid 526] ioctl(5, LOOP_CLR_FD [pid 535] <... chdir resumed>) = 0 [pid 531] mount("/dev/loop1", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 526] <... ioctl resumed>) = 0 [pid 536] set_robust_list(0x555556cc76a0, 24 [pid 535] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 531] <... mount resumed>) = -1 ENODEV (No such device) [pid 526] close(5 [pid 299] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 536] <... set_robust_list resumed>) = 0 [pid 535] <... prctl resumed>) = 0 [pid 531] ioctl(7, LOOP_CLR_FD [pid 526] <... close resumed>) = 0 [pid 536] chdir("./12" [pid 535] setpgid(0, 0 [pid 531] <... ioctl resumed>) = 0 [pid 526] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] <... chdir resumed>) = 0 [pid 535] <... setpgid resumed>) = 0 [pid 531] close(7 [pid 526] <... futex resumed>) = 0 [pid 536] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 535] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 526] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 536] <... prctl resumed>) = 0 [pid 535] <... openat resumed>) = 3 [pid 536] setpgid(0, 0 [pid 535] write(3, "1000", 4 [pid 536] <... setpgid resumed>) = 0 [pid 535] <... write resumed>) = 4 [pid 536] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 535] close(3 [pid 536] <... openat resumed>) = 3 [pid 535] <... close resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 536] write(3, "1000", 4 [pid 535] symlink("/dev/binderfs", "./binderfs" [pid 532] <... openat resumed>) = 9 [pid 299] newfstatat(AT_FDCWD, "./9/bus", [pid 532] ioctl(9, LOOP_SET_FD, 8 [pid 531] <... close resumed>) = 0 [pid 516] exit_group(0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 532] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 531] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 528] <... futex resumed>) = ? [pid 526] <... futex resumed>) = ? [pid 299] unlink("./9/bus" [pid 516] <... exit_group resumed>) = ? [pid 532] ioctl(9, LOOP_CLR_FD [pid 531] <... futex resumed>) = 0 [pid 528] +++ exited with 0 +++ [pid 526] +++ exited with 0 +++ [pid 536] <... write resumed>) = 4 [pid 535] <... symlink resumed>) = 0 [pid 532] <... ioctl resumed>) = 0 [pid 531] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... unlink resumed>) = 0 [pid 536] close(3 [pid 535] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 536] <... close resumed>) = 0 [pid 535] <... futex resumed>) = 0 [pid 536] symlink("/dev/binderfs", "./binderfs" [pid 535] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 536] <... symlink resumed>) = 0 [pid 535] <... rt_sigaction resumed>NULL, 8) = 0 [pid 299] newfstatat(AT_FDCWD, "./9/binderfs", [pid 536] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 536] <... futex resumed>) = 0 [pid 535] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 516] +++ exited with 0 +++ [pid 536] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 535] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] unlink("./9/binderfs" [pid 536] <... rt_sigaction resumed>NULL, 8) = 0 [pid 535] <... mmap resumed>) = 0x7f6220445000 [pid 536] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 535] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 536] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 535] <... mprotect resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 536] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 535] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=516, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 536] <... mmap resumed>) = 0x7f6220445000 [pid 535] <... rt_sigprocmask resumed>[], 8) = 0 [pid 532] ioctl(9, LOOP_SET_FD, 8 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 536] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 535] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 532] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 299] newfstatat(AT_FDCWD, "./9/file0", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 537 attached [pid 536] <... mprotect resumed>) = 0 [pid 532] close(9 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 536] rt_sigprocmask(SIG_BLOCK, ~[], [pid 535] <... clone3 resumed> => {parent_tid=[537]}, 88) = 537 [pid 532] <... close resumed>) = 0 [pid 299] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 536] <... rt_sigprocmask resumed>[], 8) = 0 [pid 535] rt_sigprocmask(SIG_SETMASK, [], [pid 532] close(8 [pid 296] <... openat resumed>) = 3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 536] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 535] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 535] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] <... clone3 resumed> => {parent_tid=[538]}, 88) = 538 [pid 535] <... futex resumed>) = 0 [pid 532] <... close resumed>) = 0 [pid 299] openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] newfstatat(3, "", [pid 536] rt_sigprocmask(SIG_SETMASK, [], [pid 535] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 532] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] exit_group(0 [pid 536] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 535] <... futex resumed>) = 0 [pid 531] <... futex resumed>) = ? [pid 529] <... exit_group resumed>) = ? [pid 299] <... openat resumed>) = 4 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 536] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 532] <... futex resumed>) = ? [pid 531] +++ exited with 0 +++ [pid 536] <... futex resumed>) = 0 [pid 535] <... mmap resumed>) = 0x7f6220424000 [pid 536] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 299] newfstatat(4, "", [pid 296] getdents64(3, [pid 536] <... futex resumed>) = 0 [pid 535] <... mprotect resumed>) = 0 [pid 536] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 535] rt_sigprocmask(SIG_BLOCK, ~[], [pid 536] <... mmap resumed>) = 0x7f6220424000 [pid 535] <... rt_sigprocmask resumed>[], 8) = 0 [pid 536] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 535] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 536] <... mprotect resumed>) = 0 [pid 536] rt_sigprocmask(SIG_BLOCK, ~[], [pid 535] <... clone3 resumed> => {parent_tid=[539]}, 88) = 539 [pid 536] <... rt_sigprocmask resumed>[], 8) = 0 [pid 535] rt_sigprocmask(SIG_SETMASK, [], [pid 536] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 535] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 535] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 536] <... clone3 resumed> => {parent_tid=[540]}, 88) = 540 [pid 535] <... futex resumed>) = 0 [pid 299] getdents64(4, [pid 296] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 537] set_robust_list(0x7f62204659a0, 24 [pid 536] rt_sigprocmask(SIG_SETMASK, [], [pid 535] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 537] <... set_robust_list resumed>) = 0 [pid 536] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] getdents64(4, [pid 296] <... umount2 resumed>) = 0 [pid 537] rt_sigprocmask(SIG_SETMASK, [], [pid 536] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 296] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 537] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 536] <... futex resumed>) = 0 [pid 299] close(4 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 540 attached ./strace-static-x86_64: Process 539 attached ./strace-static-x86_64: Process 538 attached [pid 536] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 537] memfd_create("syzkaller", 0) = 3 [pid 537] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 299] <... close resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./8/bus", [pid 537] <... mmap resumed>) = 0x7f6218024000 [pid 540] set_robust_list(0x7f62204449a0, 24 [pid 539] set_robust_list(0x7f62204449a0, 24 [pid 538] set_robust_list(0x7f62204659a0, 24 [pid 299] rmdir("./9/file0" [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 540] <... set_robust_list resumed>) = 0 [pid 537] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 539] <... set_robust_list resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 538] <... set_robust_list resumed>) = 0 [pid 296] unlink("./8/bus" [pid 299] getdents64(3, [pid 296] <... unlink resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 296] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] close(3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... close resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./8/binderfs", [pid 299] rmdir("./9" [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 540] rt_sigprocmask(SIG_SETMASK, [], [pid 539] rt_sigprocmask(SIG_SETMASK, [], [pid 538] rt_sigprocmask(SIG_SETMASK, [], [pid 537] <... write resumed>) = 262144 [pid 299] <... rmdir resumed>) = 0 [pid 296] unlink("./8/binderfs" [pid 540] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 539] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 538] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 537] munmap(0x7f6218024000, 262144 [pid 299] mkdir("./10", 0777 [pid 296] <... unlink resumed>) = 0 [pid 540] creat("./bus", 000 [pid 539] creat("./bus", 000 [pid 538] memfd_create("syzkaller", 0 [pid 537] <... munmap resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 296] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 539] <... creat resumed>) = 4 [pid 538] <... memfd_create resumed>) = 3 [pid 537] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 539] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 537] <... openat resumed>) = 5 [pid 299] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [ 25.196736][ T526] ext4 filesystem being mounted at /root/syzkaller.sY6u5M/8/file0 supports timestamps until 2038 (0x7fffffff) [pid 299] close(3) = 0 [pid 537] ioctl(5, LOOP_SET_FD, 3 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556cc7690) = 541 [pid 540] <... creat resumed>) = 4 [pid 540] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 540] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 541 attached [pid 541] set_robust_list(0x555556cc76a0, 24) = 0 [pid 541] chdir("./10") = 0 [pid 541] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 541] setpgid(0, 0 [pid 539] <... futex resumed>) = 1 [pid 539] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 541] <... setpgid resumed>) = 0 [pid 541] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 541] write(3, "1000", 4) = 4 [pid 541] close(3) = 0 [pid 541] symlink("/dev/binderfs", "./binderfs") = 0 [pid 541] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 541] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 541] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 541] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 541] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 536] <... futex resumed>) = 0 [pid 535] <... futex resumed>) = 0 [pid 538] <... mmap resumed>) = 0x7f6218024000 [pid 537] <... ioctl resumed>) = 0 [pid 536] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 541] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 541] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 517] +++ exited with 0 +++ [pid 510] +++ exited with 0 +++ [pid 535] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] <... futex resumed>) = 0 [pid 536] <... futex resumed>) = 1 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=510, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 540] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 540] <... mount resumed>) = 0 [pid 301] <... restart_syscall resumed>) = 0 [pid 540] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 540] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 301] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 301] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 301] getdents64(3, 0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 301] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 301] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 301] newfstatat(AT_FDCWD, "./9/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] unlink("./9/bus" [pid 539] <... futex resumed>) = 0 [pid 538] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 265740 [pid 536] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 535] <... futex resumed>) = 1 [pid 532] +++ exited with 0 +++ [pid 529] +++ exited with 0 +++ [pid 301] <... unlink resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 539] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 535] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=529, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 296] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 539] <... mount resumed>) = 0 [pid 536] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 540] <... futex resumed>) = 0 [pid 539] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] <... write resumed>) = 265740 [pid 536] <... futex resumed>) = 1 [pid 301] newfstatat(AT_FDCWD, "./9/binderfs", [pid 296] newfstatat(AT_FDCWD, "./8/file0", [pid 540] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 539] <... futex resumed>) = 1 [pid 538] munmap(0x7f6218024000, 265740 [pid 537] close(3 [pid 536] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 535] <... futex resumed>) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 541] <... clone3 resumed> => {parent_tid=[542]}, 88) = 542 [pid 540] <... open resumed>) = 5 [pid 539] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 538] <... munmap resumed>) = 0 [pid 537] <... close resumed>) = 0 [pid 535] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] unlink("./9/binderfs" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./8/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 541] rt_sigprocmask(SIG_SETMASK, [], [pid 540] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 539] <... open resumed>) = 3 [pid 538] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 537] mkdir("./file0", 0777 [pid 535] <... futex resumed>) = 0 [pid 301] <... unlink resumed>) = 0 [pid 297] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 541] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 540] <... futex resumed>) = 1 [pid 539] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] <... openat resumed>) = 6 [pid 537] <... mkdir resumed>) = 0 [pid 536] <... futex resumed>) = 0 [pid 535] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... openat resumed>) = 3 [pid 296] openat(AT_FDCWD, "./8/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 541] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 539] <... futex resumed>) = 0 [pid 538] ioctl(6, LOOP_SET_FD, 3 [pid 537] mount("/dev/loop2", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 536] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(3, "", [pid 296] <... openat resumed>) = 4 [pid 541] <... futex resumed>) = 0 [pid 540] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 539] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 536] <... futex resumed>) = 0 [pid 535] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] newfstatat(AT_FDCWD, "./9/file0", [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] newfstatat(4, "", [pid 541] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 539] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] getdents64(3, [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 541] <... futex resumed>) = 0 [pid 540] <... socket resumed>) = 7 [pid 539] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 301] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 128 [pid 296] getdents64(4, [pid 541] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 540] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 539] <... socket resumed>) = 6 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 541] <... mmap resumed>) = 0x7f6220424000 [pid 540] <... futex resumed>) = 0 [pid 539] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] getdents64(4, [pid 541] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 540] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 539] <... futex resumed>) = 0 [pid 301] <... openat resumed>) = 4 [pid 296] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 541] <... mprotect resumed>) = 0 [pid 539] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] newfstatat(4, "", [pid 296] close(4 [pid 541] rt_sigprocmask(SIG_BLOCK, ~[], [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... close resumed>) = 0 [pid 541] <... rt_sigprocmask resumed>[], 8) = 0 [pid 301] getdents64(4, [pid 296] rmdir("./8/file0" [pid 541] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 301] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 296] <... rmdir resumed>) = 0 [pid 301] getdents64(4, [pid 296] getdents64(3, [pid 541] <... clone3 resumed> => {parent_tid=[543]}, 88) = 543 [pid 301] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 541] rt_sigprocmask(SIG_SETMASK, [], [pid 301] close(4 [pid 296] close(3 [pid 541] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 541] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] rmdir("./9/file0" [pid 296] rmdir("./8" [pid 541] <... futex resumed>) = 0 [pid 301] <... rmdir resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 542 attached [pid 541] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 539] <... futex resumed>) = 0 [pid 536] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 535] <... futex resumed>) = 1 [pid 301] getdents64(3, [pid 297] <... umount2 resumed>) = 0 [pid 296] mkdir("./9", 0777 [pid 539] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 535] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 297] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... mkdir resumed>) = 0 [pid 542] set_robust_list(0x7f62204659a0, 24 [pid 536] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] close(3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 542] <... set_robust_list resumed>) = 0 [pid 540] <... futex resumed>) = 0 [pid 536] <... futex resumed>) = 1 [pid 535] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... close resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./10/bus", [pid 296] <... openat resumed>) = 3 [pid 542] rt_sigprocmask(SIG_SETMASK, [], [pid 540] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 539] <... futex resumed>) = 0 [pid 538] <... ioctl resumed>) = 0 [pid 536] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 535] <... futex resumed>) = 1 [pid 301] rmdir("./9" [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 25.226090][ T537] loop2: detected capacity change from 0 to 512 [ 25.247765][ T538] loop4: detected capacity change from 0 to 519 [pid 296] ioctl(3, LOOP_CLR_FD [pid 542] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 540] <... mmap resumed>) = 0x20000000 [pid 539] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 3, 0 [pid 538] close(3 [pid 535] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... rmdir resumed>) = 0 [pid 297] unlink("./10/bus"./strace-static-x86_64: Process 543 attached [pid 540] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] <... close resumed>) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 543] set_robust_list(0x7f62204449a0, 24 [pid 538] mkdir(0x20000000, 0777 [pid 543] <... set_robust_list resumed>) = 0 [pid 538] <... mkdir resumed>) = -1 ENOENT (No such file or directory) [pid 543] rt_sigprocmask(SIG_SETMASK, [], [pid 538] mount("/dev/loop4", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 543] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 538] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 543] creat("./bus", 000 [pid 538] ioctl(6, LOOP_CLR_FD [pid 543] <... creat resumed>) = 3 [pid 540] <... futex resumed>) = 1 [pid 538] <... ioctl resumed>) = 0 [pid 536] <... futex resumed>) = 0 [pid 301] mkdir("./10", 0777 [pid 297] <... unlink resumed>) = 0 [pid 296] close(3 [pid 543] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] close(6 [pid 543] <... futex resumed>) = 1 [pid 538] <... close resumed>) = 0 [pid 543] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 538] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 538] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 539] <... mmap resumed>) = 0x20000000 [pid 539] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] <... futex resumed>) = 0 [pid 535] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 539] <... futex resumed>) = 1 [pid 539] memfd_create("syzkaller", 0) = 7 [pid 539] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f620fc64000 [pid 539] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536) = 65536 [pid 536] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] <... futex resumed>) = 0 [pid 536] <... futex resumed>) = 1 [pid 540] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... close resumed>) = 0 [pid 538] memfd_create("syzkaller", 0 [pid 297] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 538] <... memfd_create resumed>) = 3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 539] munmap(0x7f620fc64000, 65536) = 0 [pid 538] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 297] newfstatat(AT_FDCWD, "./10/binderfs", [pid 539] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 8 [pid 539] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 539] ioctl(8, LOOP_CLR_FD) = 0 [pid 301] <... mkdir resumed>) = 0 [pid 538] <... mmap resumed>) = 0x7f620fc65000 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 296] <... clone resumed>, child_tidptr=0x555556cc7690) = 546 ./strace-static-x86_64: Process 546 attached [pid 546] set_robust_list(0x555556cc76a0, 24) = 0 [pid 546] chdir("./9") = 0 [pid 538] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 297] unlink("./10/binderfs" [pid 546] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 538] <... write resumed>) = 65536 [pid 546] <... prctl resumed>) = 0 [pid 546] setpgid(0, 0) = 0 [pid 297] <... unlink resumed>) = 0 [pid 297] umount2("./10/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 301] <... openat resumed>) = 3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 541] <... futex resumed>) = 0 [pid 538] munmap(0x7f620fc65000, 65536 [pid 301] ioctl(3, LOOP_CLR_FD [pid 546] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 539] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 539] close(8 [pid 541] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] <... munmap resumed>) = 0 [pid 301] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] newfstatat(AT_FDCWD, "./10/ext4", [pid 539] <... close resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 538] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 301] close(3 [pid 297] umount2("./10/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 541] <... futex resumed>) = 1 [pid 543] <... futex resumed>) = 0 [pid 538] <... openat resumed>) = 6 [pid 301] <... close resumed>) = 0 [pid 543] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 541] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 538] ioctl(6, LOOP_SET_FD, 3 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 543] <... mount resumed>) = 0 [pid 538] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 297] openat(AT_FDCWD, "./10/ext4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 543] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] ioctl(6, LOOP_CLR_FD [pid 297] <... openat resumed>) = 4 [pid 543] <... futex resumed>) = 1 [pid 538] <... ioctl resumed>) = 0 [pid 541] <... futex resumed>) = 0 [pid 301] <... clone resumed>, child_tidptr=0x555556cc7690) = 547 [pid 297] newfstatat(4, "", [pid 543] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(4, 0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 541] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] close(4 [pid 543] <... futex resumed>) = 0 [pid 541] <... futex resumed>) = 1 [pid 538] ioctl(6, LOOP_SET_FD, 3 [pid 297] <... close resumed>) = 0 [pid 543] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 541] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 538] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 297] rmdir("./10/ext4" [pid 543] <... open resumed>) = 4 [pid 538] close(6 [pid 543] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] <... close resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 543] <... futex resumed>) = 1 [pid 541] <... futex resumed>) = 0 [pid 538] close(3 [pid 297] getdents64(3, [pid 543] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 541] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 539] close(7 [pid 543] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 541] <... futex resumed>) = 0 [pid 539] <... close resumed>) = 0 [pid 538] <... close resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 543] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 541] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 538] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] close(3 [pid 543] <... socket resumed>) = 5 [pid 538] <... futex resumed>) = 0 [pid 543] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 538] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... close resumed>) = 0 [pid 543] <... futex resumed>) = 1 [pid 541] <... futex resumed>) = 0 [pid 297] rmdir("./10" [pid 543] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 541] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 539] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 539] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 543] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 541] <... futex resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 543] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0 [pid 536] exit_group(0 [pid 543] <... mmap resumed>) = 0x20000000 [pid 541] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 540] <... futex resumed>) = ? [pid 538] <... futex resumed>) = ? [pid 536] <... exit_group resumed>) = ? [pid 297] mkdir("./11", 0777 [pid 543] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 541] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 540] +++ exited with 0 +++ [pid 546] <... openat resumed>) = 3 [pid 546] write(3, "1000", 4) = 4 [pid 546] close(3) = 0 [pid 546] symlink("/dev/binderfs", "./binderfs") = 0 [pid 546] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 543] <... futex resumed>) = 0 [pid 541] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... rt_sigaction resumed>NULL, 8) = 0 [pid 546] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 546] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 297] <... mkdir resumed>) = 0 [pid 543] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 541] <... futex resumed>) = 0 [pid 546] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 546] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 546] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] <... openat resumed>) = 3 [pid 546] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3 [pid 546] <... clone3 resumed> => {parent_tid=[548]}, 88) = 548 [pid 297] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 546] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 546] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556cc7690) = 549 [pid 546] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 546] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 546] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 546] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[550]}, 88) = 550 [pid 546] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 546] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 550 attached [pid 550] set_robust_list(0x7f62204449a0, 24) = 0 [pid 550] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 550] creat("./bus", 000) = 3 [pid 550] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... futex resumed>) = 0 [pid 546] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 550] <... futex resumed>) = 1 [pid 550] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 550] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... futex resumed>) = 0 [pid 546] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 550] <... futex resumed>) = 1 [pid 550] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 ./strace-static-x86_64: Process 547 attached [ 25.267659][ T537] EXT4-fs (loop2): mounted filesystem without journal. Opts: nodiscard,barrier,nouid32,grpquota,,errors=continue. Quota mode: writeback. ./strace-static-x86_64: Process 549 attached ./strace-static-x86_64: Process 548 attached [pid 547] set_robust_list(0x555556cc76a0, 24 [pid 550] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... futex resumed>) = 0 [pid 546] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 550] <... futex resumed>) = 1 [pid 550] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE) = 5 [pid 550] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... futex resumed>) = 0 [pid 546] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 550] <... futex resumed>) = 1 [pid 550] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0) = 0x20000000 [pid 550] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] <... futex resumed>) = 0 [pid 546] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] <... futex resumed>) = 1 [pid 550] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 549] set_robust_list(0x555556cc76a0, 24) = 0 [pid 549] chdir("./11") = 0 [pid 549] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 549] setpgid(0, 0) = 0 [pid 549] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 549] write(3, "1000", 4) = 4 [pid 549] close(3) = 0 [pid 549] symlink("/dev/binderfs", "./binderfs") = 0 [pid 549] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 549] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 549] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 549] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 549] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 549] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 549] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[551]}, 88) = 551 [pid 549] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 547] <... set_robust_list resumed>) = 0 ./strace-static-x86_64: Process 551 attached [pid 549] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] chdir("./10" [pid 542] +++ killed by SIGBUS +++ [pid 537] <... mount resumed>) = 0 [pid 551] set_robust_list(0x7f62204659a0, 24 [pid 549] <... futex resumed>) = 0 [pid 548] +++ killed by SIGBUS +++ [pid 547] <... chdir resumed>) = 0 [pid 543] +++ killed by SIGBUS +++ [pid 541] +++ killed by SIGBUS +++ [pid 547] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=541, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 547] <... prctl resumed>) = 0 [pid 547] setpgid(0, 0) = 0 [pid 547] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 547] write(3, "1000", 4) = 4 [pid 547] close(3) = 0 [pid 547] symlink("/dev/binderfs", "./binderfs" [pid 549] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] <... symlink resumed>) = 0 [pid 547] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 547] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 547] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 547] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 550] +++ killed by SIGBUS +++ [pid 547] <... mmap resumed>) = 0x7f6220445000 [pid 546] +++ killed by SIGBUS +++ [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 549] <... futex resumed>) = 0 [pid 547] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 299] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=546, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 549] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 547] <... mprotect resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 547] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] newfstatat(3, "", [pid 547] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 547] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 299] getdents64(3, [pid 549] <... mmap resumed>) = 0x7f6220424000 [pid 299] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 547] <... clone3 resumed> => {parent_tid=[552]}, 88) = 552 [pid 299] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... restart_syscall resumed>) = 0 [pid 547] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... umount2 resumed>) = 0 [pid 547] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 549] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 547] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 551] <... set_robust_list resumed>) = 0 [pid 549] <... mprotect resumed>) = 0 [pid 547] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./10/bus", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 551] rt_sigprocmask(SIG_SETMASK, [], [pid 549] rt_sigprocmask(SIG_BLOCK, ~[], [pid 547] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 551] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 549] <... rt_sigprocmask resumed>[], 8) = 0 [pid 547] <... futex resumed>) = 0 [pid 299] unlink("./10/bus" [pid 296] <... openat resumed>) = 3 [pid 551] memfd_create("syzkaller", 0 [pid 549] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 547] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 537] openat(AT_FDCWD, 0x20000000, O_RDONLY|O_DIRECTORY [pid 299] <... unlink resumed>) = 0 [pid 296] newfstatat(3, "", ./strace-static-x86_64: Process 552 attached [pid 551] <... memfd_create resumed>) = 3 [pid 547] <... mmap resumed>) = 0x7f6220424000 [pid 299] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 551] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 547] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] getdents64(3, [pid 551] <... mmap resumed>) = 0x7f6218024000 [pid 547] <... mprotect resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./10/binderfs", [pid 296] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 552] set_robust_list(0x7f62204659a0, 24 [pid 551] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 547] rt_sigprocmask(SIG_BLOCK, ~[], [pid 537] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 552] <... set_robust_list resumed>) = 0 [pid 551] <... write resumed>) = 262144 [pid 549] <... clone3 resumed> => {parent_tid=[553]}, 88) = 553 [pid 547] <... rt_sigprocmask resumed>[], 8) = 0 [pid 537] ioctl(5, LOOP_CLR_FD [pid 299] unlink("./10/binderfs" [pid 296] <... umount2 resumed>) = 0 [pid 551] munmap(0x7f6218024000, 262144 [pid 549] rt_sigprocmask(SIG_SETMASK, [], [pid 547] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 299] <... unlink resumed>) = 0 [pid 296] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 552] rt_sigprocmask(SIG_SETMASK, [], [pid 551] <... munmap resumed>) = 0 [pid 549] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 537] <... ioctl resumed>) = 0 [pid 299] getdents64(3, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 551] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 547] <... clone3 resumed> => {parent_tid=[554]}, 88) = 554 [pid 299] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 296] newfstatat(AT_FDCWD, "./9/bus", [pid 551] <... openat resumed>) = 4 [pid 547] rt_sigprocmask(SIG_SETMASK, [], [pid 299] close(3 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 551] ioctl(4, LOOP_SET_FD, 3 [pid 547] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... close resumed>) = 0 [pid 296] unlink("./9/bus"./strace-static-x86_64: Process 553 attached ./strace-static-x86_64: Process 554 attached [pid 552] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 551] <... ioctl resumed>) = 0 [pid 549] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 537] close(5 [pid 299] rmdir("./10" [pid 296] <... unlink resumed>) = 0 [pid 553] set_robust_list(0x7f62204449a0, 24 [pid 547] <... futex resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 296] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 552] memfd_create("syzkaller", 0 [pid 549] <... futex resumed>) = 0 [pid 547] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 537] <... close resumed>) = 0 [pid 299] mkdir("./11", 0777 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 553] <... set_robust_list resumed>) = 0 [pid 554] set_robust_list(0x7f62204449a0, 24 [pid 552] <... memfd_create resumed>) = 3 [pid 551] close(3 [pid 549] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 537] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... mkdir resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./9/binderfs", [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] unlink("./9/binderfs" [pid 299] ioctl(3, LOOP_CLR_FD [pid 296] <... unlink resumed>) = 0 [pid 554] <... set_robust_list resumed>) = 0 [pid 553] rt_sigprocmask(SIG_SETMASK, [], [pid 552] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 537] <... futex resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] getdents64(3, [pid 299] close(3 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 299] <... close resumed>) = 0 [pid 296] close(3 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... close resumed>) = 0 [pid 554] rt_sigprocmask(SIG_SETMASK, [], [pid 553] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 552] <... mmap resumed>) = 0x7f6218024000 [pid 551] <... close resumed>) = 0 [pid 537] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 555 attached [pid 554] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 553] creat("./bus", 000 [pid 552] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 538] +++ exited with 0 +++ [pid 536] +++ exited with 0 +++ [pid 296] rmdir("./9" [pid 555] set_robust_list(0x555556cc76a0, 24 [pid 299] <... clone resumed>, child_tidptr=0x555556cc7690) = 555 [pid 296] <... rmdir resumed>) = 0 [pid 555] <... set_robust_list resumed>) = 0 [pid 296] mkdir("./10", 0777 [pid 555] chdir("./11" [pid 296] <... mkdir resumed>) = 0 [pid 555] <... chdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 555] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 296] <... openat resumed>) = 3 [pid 555] <... prctl resumed>) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 555] setpgid(0, 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 555] <... setpgid resumed>) = 0 [pid 296] close(3 [pid 555] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 296] <... close resumed>) = 0 [pid 555] <... openat resumed>) = 3 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 555] write(3, "1000", 4) = 4 [pid 296] <... clone resumed>, child_tidptr=0x555556cc7690) = 556 [pid 555] close(3) = 0 ./strace-static-x86_64: Process 556 attached [pid 555] symlink("/dev/binderfs", "./binderfs" [pid 554] creat("./bus", 000 [pid 553] <... creat resumed>) = 3 [pid 552] <... write resumed>) = 262144 [pid 535] exit_group(0 [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=536, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 556] set_robust_list(0x555556cc76a0, 24) = 0 [pid 556] chdir("./10") = 0 [pid 556] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 556] setpgid(0, 0) = 0 [pid 556] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 556] write(3, "1000", 4) = 4 [pid 556] close(3) = 0 [pid 556] symlink("/dev/binderfs", "./binderfs") = 0 [pid 556] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 556] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 556] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 539] <... futex resumed>) = ? [pid 537] <... futex resumed>) = ? [pid 535] <... exit_group resumed>) = ? [pid 553] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 556] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 556] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 554] <... creat resumed>) = 4 [pid 539] +++ exited with 0 +++ [pid 537] +++ exited with 0 +++ [pid 556] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 556] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 556] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[557]}, 88) = 557 [pid 556] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 556] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 554] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 553] <... futex resumed>) = 1 [pid 549] <... futex resumed>) = 0 [pid 535] +++ exited with 0 +++ [pid 300] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 556] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 556] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 556] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 556] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 556] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[558]}, 88) = 558 [pid 556] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 556] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 556] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 557 attached [pid 549] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=535, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 549] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 554] <... futex resumed>) = 1 [pid 553] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 547] <... futex resumed>) = 0 [pid 547] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 298] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 557] set_robust_list(0x7f62204659a0, 24) = 0 [pid 557] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 300] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... openat resumed>) = 3 [pid 298] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] newfstatat(3, "", [pid 298] <... openat resumed>) = 3 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 553] <... mount resumed>) = 0 [pid 298] newfstatat(3, "", [pid 554] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 553] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] getdents64(3, [pid 557] memfd_create("syzkaller", 0) = 3 [pid 557] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218024000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 298] getdents64(3, 0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 300] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 553] <... futex resumed>) = 1 [pid 549] <... futex resumed>) = 0 [pid 553] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 549] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = 0 [pid 554] <... mount resumed>) = 0 [pid 549] <... futex resumed>) = 0 [pid 553] <... open resumed>) = 5 [pid 298] <... umount2 resumed>) = 0 [pid 549] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 554] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 557] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 557] munmap(0x7f6218024000, 262144) = 0 [pid 557] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [ 25.305375][ T537] ext4 filesystem being mounted at /root/syzkaller.4RDDfu/9/file0 supports timestamps until 2038 (0x7fffffff) [ 25.328467][ T551] loop1: detected capacity change from 0 to 512 [pid 557] ioctl(4, LOOP_SET_FD, 3 [pid 554] <... futex resumed>) = 1 [pid 553] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 552] munmap(0x7f6218024000, 262144 [pid 547] <... futex resumed>) = 0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 554] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 553] <... futex resumed>) = 1 [pid 552] <... munmap resumed>) = 0 [pid 549] <... futex resumed>) = 0 [pid 547] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] newfstatat(AT_FDCWD, "./12/bus", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 549] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] <... futex resumed>) = 0 [pid 553] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 549] <... futex resumed>) = 0 [pid 547] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] newfstatat(AT_FDCWD, "./9/bus", [pid 553] <... socket resumed>) = 6 [pid 549] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] unlink("./12/bus" [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 553] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 549] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 557] <... ioctl resumed>) = 0 [pid 557] close(3 [pid 553] <... futex resumed>) = 0 [pid 549] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... unlink resumed>) = 0 [pid 298] unlink("./9/bus" [pid 553] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 549] <... futex resumed>) = 0 [pid 300] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 557] <... close resumed>) = 0 [pid 557] mkdir("./file0", 0777 [pid 298] <... unlink resumed>) = 0 [pid 549] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 553] <... mmap resumed>) = 0x20000000 [pid 298] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 553] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 553] <... futex resumed>) = 1 [pid 549] <... futex resumed>) = 0 [pid 300] newfstatat(AT_FDCWD, "./12/binderfs", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 554] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 553] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 549] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] newfstatat(AT_FDCWD, "./9/binderfs", [pid 554] <... open resumed>) = 5 [pid 553] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 549] <... futex resumed>) = 0 [pid 300] unlink("./12/binderfs" [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 554] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 553] memfd_create("syzkaller", 0 [pid 298] unlink("./9/binderfs" [pid 553] <... memfd_create resumed>) = 7 [pid 298] <... unlink resumed>) = 0 [pid 553] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 300] <... unlink resumed>) = 0 [pid 553] <... mmap resumed>) = 0x7f620fc64000 [pid 554] <... futex resumed>) = 1 [pid 547] <... futex resumed>) = 0 [pid 298] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 557] <... mkdir resumed>) = 0 [pid 557] mount("/dev/loop0", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 553] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 547] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 554] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 300] getdents64(3, [pid 547] <... futex resumed>) = 0 [pid 554] <... socket resumed>) = 6 [pid 547] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 554] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 547] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 554] <... futex resumed>) = 0 [pid 300] close(3 [pid 547] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 554] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 300] <... close resumed>) = 0 [pid 554] <... mmap resumed>) = 0x20000000 [pid 554] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] rmdir("./12" [pid 553] <... write resumed>) = 65536 [pid 300] <... rmdir resumed>) = 0 [pid 554] <... futex resumed>) = 1 [pid 553] munmap(0x7f620fc64000, 65536 [pid 547] <... futex resumed>) = 0 [pid 300] mkdir("./13", 0777 [pid 547] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 554] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 547] <... futex resumed>) = 0 [pid 300] <... mkdir resumed>) = 0 [pid 553] <... munmap resumed>) = 0 [pid 553] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 8 [pid 553] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 553] ioctl(8, LOOP_CLR_FD [pid 300] <... openat resumed>) = 3 [pid 553] <... ioctl resumed>) = 0 [pid 300] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 300] close(3 [pid 298] <... umount2 resumed>) = 0 [pid 554] +++ killed by SIGBUS +++ [pid 552] +++ killed by SIGBUS +++ [pid 547] +++ killed by SIGBUS +++ [pid 300] <... close resumed>) = 0 [pid 298] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 553] ioctl(8, LOOP_SET_FD, 7 [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=547, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 553] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 558 attached [pid 555] <... symlink resumed>) = 0 [pid 553] close(8 [pid 551] mkdir(0x20000000, 0777 [pid 298] newfstatat(AT_FDCWD, "./9/file0", [pid 555] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 553] <... close resumed>) = 0 [pid 301] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 559 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 558] set_robust_list(0x7f62204449a0, 24 [pid 555] <... futex resumed>) = 0 [pid 553] close(7 [pid 551] <... mkdir resumed>) = 0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./9/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 555] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 553] <... close resumed>) = 0 [pid 551] mount("/dev/loop1", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 301] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 559 attached [pid 558] <... set_robust_list resumed>) = 0 [pid 555] <... rt_sigaction resumed>NULL, 8) = 0 [pid 553] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] <... mount resumed>) = -1 ENODEV (No such device) [pid 301] <... openat resumed>) = 3 [pid 298] openat(AT_FDCWD, "./9/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 559] set_robust_list(0x555556cc76a0, 24 [pid 558] rt_sigprocmask(SIG_SETMASK, [], [pid 555] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 553] <... futex resumed>) = 0 [pid 551] ioctl(4, LOOP_CLR_FD [pid 301] newfstatat(3, "", [pid 298] <... openat resumed>) = 4 [pid 559] <... set_robust_list resumed>) = 0 [pid 558] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 555] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 553] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 551] <... ioctl resumed>) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] newfstatat(4, "", [pid 558] creat("./bus", 000 [pid 555] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 559] chdir("./13" [pid 555] <... mmap resumed>) = 0x7f6220445000 [pid 551] close(4 [pid 301] getdents64(3, [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 559] <... chdir resumed>) = 0 [pid 559] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 551] <... close resumed>) = 0 [pid 298] getdents64(4, [pid 559] <... prctl resumed>) = 0 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 555] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 551] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 301] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 559] setpgid(0, 0) = 0 [pid 559] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 555] <... mprotect resumed>) = 0 [pid 558] <... creat resumed>) = 3 [pid 551] <... futex resumed>) = 0 [pid 301] <... umount2 resumed>) = 0 [pid 298] getdents64(4, [pid 559] <... openat resumed>) = 3 [pid 559] write(3, "1000", 4) = 4 [pid 558] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] rt_sigprocmask(SIG_BLOCK, ~[], [pid 551] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 559] close(3) = 0 [pid 559] symlink("/dev/binderfs", "./binderfs") = 0 [pid 558] <... futex resumed>) = 1 [pid 556] <... futex resumed>) = 0 [pid 555] <... rt_sigprocmask resumed>[], 8) = 0 [pid 549] exit_group(0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] close(4 [pid 559] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 556] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] <... futex resumed>) = 0 [pid 558] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 556] <... futex resumed>) = 0 [pid 555] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 553] <... futex resumed>) = ? [pid 551] <... futex resumed>) = ? [pid 549] <... exit_group resumed>) = ? [pid 301] newfstatat(AT_FDCWD, "./10/bus", [pid 298] <... close resumed>) = 0 [pid 559] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 556] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 559] <... rt_sigaction resumed>NULL, 8) = 0 [pid 553] +++ exited with 0 +++ [pid 551] +++ exited with 0 +++ [pid 559] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 559] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 559] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 559] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 559] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 549] +++ exited with 0 +++ [pid 301] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] rmdir("./9/file0" [pid 559] <... clone3 resumed> => {parent_tid=[562]}, 88) = 562 [pid 559] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 559] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 559] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 559] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... rmdir resumed>) = 0 [pid 555] <... clone3 resumed> => {parent_tid=[561]}, 88) = 561 [pid 301] unlink("./10/bus" [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=549, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 559] <... mmap resumed>) = 0x7f6220424000 [pid 559] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 301] <... unlink resumed>) = 0 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 555] rt_sigprocmask(SIG_SETMASK, [], [pid 298] getdents64(3, [pid 555] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 555] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 555] <... futex resumed>) = 0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 555] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] newfstatat(AT_FDCWD, "./10/binderfs", [pid 298] close(3 [pid 555] <... futex resumed>) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 555] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 555] <... mmap resumed>) = 0x7f6220424000 [pid 301] unlink("./10/binderfs" [pid 298] <... close resumed>) = 0 [pid 555] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 561 attached [pid 559] rt_sigprocmask(SIG_BLOCK, ~[], [pid 558] <... mount resumed>) = 0 [pid 555] <... mprotect resumed>) = 0 [pid 301] <... unlink resumed>) = 0 [pid 298] rmdir("./9" [pid 297] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 561] set_robust_list(0x7f62204659a0, 24 [pid 559] <... rt_sigprocmask resumed>[], 8) = 0 [pid 558] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] rt_sigprocmask(SIG_BLOCK, ~[], [pid 301] getdents64(3, [pid 561] <... set_robust_list resumed>) = 0 [pid 559] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 561] rt_sigprocmask(SIG_SETMASK, [], [pid 558] <... futex resumed>) = 1 [pid 556] <... futex resumed>) = 0 [pid 555] <... rt_sigprocmask resumed>[], 8) = 0 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 561] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 559] <... clone3 resumed> => {parent_tid=[564]}, 88) = 564 [pid 556] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 301] close(3 [pid 558] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 298] mkdir("./10", 0777 [pid 297] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 561] memfd_create("syzkaller", 0 [pid 559] rt_sigprocmask(SIG_SETMASK, [], [pid 558] <... open resumed>) = 5 [pid 556] <... futex resumed>) = 0 [pid 301] <... close resumed>) = 0 [pid 561] <... memfd_create resumed>) = 3 [pid 559] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 556] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... openat resumed>) = 3 [pid 561] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 559] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 561] <... mmap resumed>) = 0x7f6218024000 [pid 559] <... futex resumed>) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 297] newfstatat(3, "", ./strace-static-x86_64: Process 565 attached ./strace-static-x86_64: Process 564 attached ./strace-static-x86_64: Process 562 attached [pid 559] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 558] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] <... clone3 resumed> => {parent_tid=[565]}, 88) = 565 [pid 301] rmdir("./10" [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 565] set_robust_list(0x7f62204449a0, 24 [pid 564] set_robust_list(0x7f62204449a0, 24 [pid 562] set_robust_list(0x7f62204659a0, 24 [pid 558] <... futex resumed>) = 1 [pid 555] rt_sigprocmask(SIG_SETMASK, [], [pid 301] <... rmdir resumed>) = 0 [pid 297] getdents64(3, [pid 565] <... set_robust_list resumed>) = 0 [pid 564] <... set_robust_list resumed>) = 0 [pid 562] <... set_robust_list resumed>) = 0 [pid 558] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 555] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] mkdir("./11", 0777 [pid 297] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 128 [pid 565] rt_sigprocmask(SIG_SETMASK, [], [pid 564] rt_sigprocmask(SIG_SETMASK, [], [pid 562] rt_sigprocmask(SIG_SETMASK, [], [pid 555] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... mkdir resumed>) = 0 [pid 297] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 565] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 564] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 562] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 555] <... futex resumed>) = 0 [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 565] creat("./bus", 000 [pid 564] creat("./bus", 000 [pid 562] memfd_create("syzkaller", 0 [pid 555] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] <... openat resumed>) = 3 [pid 565] <... creat resumed>) = 4 [pid 564] <... creat resumed>) = 3 [pid 562] <... memfd_create resumed>) = 4 [pid 301] ioctl(3, LOOP_CLR_FD [pid 565] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 564] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 562] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 301] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 565] <... futex resumed>) = 1 [pid 564] <... futex resumed>) = 0 [pid 562] <... mmap resumed>) = 0x7f6218024000 [pid 555] <... futex resumed>) = 0 [pid 301] close(3 [pid 565] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 564] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 562] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 555] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... close resumed>) = 0 [pid 565] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 562] <... write resumed>) = 262144 [pid 555] <... futex resumed>) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 565] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 562] munmap(0x7f6218024000, 262144 [pid 555] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 565] <... mount resumed>) = 0 [pid 562] <... munmap resumed>) = 0 [pid 301] <... clone resumed>, child_tidptr=0x555556cc7690) = 566 [pid 565] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [ 25.362073][ T557] loop0: detected capacity change from 0 to 512 [pid 562] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 565] <... futex resumed>) = 1 [pid 562] <... openat resumed>) = 5 [pid 559] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 556] <... futex resumed>) = 0 [pid 555] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 565] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 562] ioctl(5, LOOP_SET_FD, 4 [pid 559] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 556] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 566 attached [pid 565] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 562] <... ioctl resumed>) = 0 [pid 561] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 555] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 565] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 562] close(4 [pid 555] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] newfstatat(AT_FDCWD, "./11/bus", [pid 565] <... open resumed>) = 5 [pid 562] <... close resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 565] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 562] mkdir("./file0", 0777 [pid 297] unlink("./11/bus" [pid 565] <... futex resumed>) = 1 [pid 562] <... mkdir resumed>) = 0 [pid 555] <... futex resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 565] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 562] mount("/dev/loop4", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 555] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 565] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 555] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 565] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 555] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] newfstatat(AT_FDCWD, "./11/binderfs", [pid 565] <... socket resumed>) = 6 [pid 298] <... openat resumed>) = 3 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 565] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] unlink("./11/binderfs" [pid 565] <... futex resumed>) = 1 [pid 555] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... unlink resumed>) = 0 [pid 565] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 555] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 297] umount2("./11/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 565] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 555] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 565] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 555] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] newfstatat(AT_FDCWD, "./11/ext4", [pid 565] <... mmap resumed>) = 0x20000000 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 565] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 568 [pid 297] umount2("./11/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 565] <... futex resumed>) = 1 [pid 555] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 565] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 555] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] openat(AT_FDCWD, "./11/ext4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 565] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 555] <... futex resumed>) = 0 [pid 297] <... openat resumed>) = 4 [pid 565] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 555] stat(NULL, [pid 297] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(4, [pid 559] <... futex resumed>) = 1 [pid 297] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 566] set_robust_list(0x555556cc76a0, 24 [pid 556] <... futex resumed>) = 1 [pid 297] getdents64(4, 0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./11/ext4" [pid 566] <... set_robust_list resumed>) = 0 [pid 564] <... futex resumed>) = 0 [pid 561] <... write resumed>) = ? [pid 559] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 558] <... futex resumed>) = 0 [pid 556] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... rmdir resumed>) = 0 [pid 566] chdir("./11" [pid 564] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 561] +++ killed by SIGBUS +++ [pid 558] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 297] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./11") = 0 [pid 297] mkdir("./12", 0777 [pid 558] <... socket resumed>) = 6 [pid 297] <... mkdir resumed>) = 0 [pid 564] <... mount resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 566] <... chdir resumed>) = 0 [pid 565] +++ killed by SIGBUS +++ [pid 564] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] +++ killed by SIGBUS +++ [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 566] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 564] <... futex resumed>) = 1 [pid 559] <... futex resumed>) = 0 [pid 558] <... futex resumed>) = 1 [pid 556] <... futex resumed>) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=555, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 297] close(3 [pid 566] <... prctl resumed>) = 0 [pid 564] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 559] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 556] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 297] <... close resumed>) = 0 [pid 566] setpgid(0, 0 [pid 564] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 559] <... futex resumed>) = 0 [pid 558] <... mmap resumed>) = 0x20000000 [pid 556] <... futex resumed>) = 0 [pid 299] <... restart_syscall resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 566] <... setpgid resumed>) = 0 [pid 564] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 559] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 558] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 556] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 566] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 564] <... open resumed>) = 4 [pid 558] <... futex resumed>) = 0 [pid 556] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] <... clone resumed>, child_tidptr=0x555556cc7690) = 569 [pid 566] <... openat resumed>) = 3 [pid 564] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] memfd_create("syzkaller", 0 [pid 556] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 566] write(3, "1000", 4 [pid 564] <... futex resumed>) = 1 [pid 559] <... futex resumed>) = 0 [pid 558] <... memfd_create resumed>) = 7 [pid 556] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 566] <... write resumed>) = 4 [pid 564] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 559] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 299] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 566] close(3 [pid 564] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 559] <... futex resumed>) = 0 [pid 558] <... mmap resumed>) = 0x7f620fc64000 [pid 299] <... openat resumed>) = 3 ./strace-static-x86_64: Process 569 attached ./strace-static-x86_64: Process 568 attached [pid 566] <... close resumed>) = 0 [pid 564] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 559] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 558] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 557] <... mount resumed>) = 0 [pid 299] newfstatat(3, "", [pid 568] set_robust_list(0x555556cc76a0, 24 [pid 566] symlink("/dev/binderfs", "./binderfs" [pid 564] <... socket resumed>) = 6 [pid 558] <... write resumed>) = 65536 [pid 566] <... symlink resumed>) = 0 [pid 564] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] munmap(0x7f620fc64000, 65536 [pid 557] openat(AT_FDCWD, 0x20000000, O_RDONLY|O_DIRECTORY [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 568] <... set_robust_list resumed>) = 0 [pid 566] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 564] <... futex resumed>) = 1 [pid 559] <... futex resumed>) = 0 [pid 558] <... munmap resumed>) = 0 [pid 566] <... futex resumed>) = 0 [pid 564] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 559] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 566] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 564] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 559] <... futex resumed>) = 0 [pid 558] <... openat resumed>) = 8 [pid 557] <... openat resumed>) = -1 ENOENT (No such file or directory) [pid 299] getdents64(3, [pid 568] chdir("./10" [pid 566] <... rt_sigaction resumed>NULL, 8) = 0 [pid 564] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0 [pid 559] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 558] ioctl(8, LOOP_SET_FD, 7 [pid 557] ioctl(4, LOOP_CLR_FD [pid 299] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 568] <... chdir resumed>) = 0 [pid 566] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 564] <... mmap resumed>) = 0x20000000 [pid 558] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 557] <... ioctl resumed>) = 0 [pid 299] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 568] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 566] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 564] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] ioctl(8, LOOP_CLR_FD [pid 557] close(4 [pid 566] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 564] <... futex resumed>) = 1 [pid 559] <... futex resumed>) = 0 [pid 558] <... ioctl resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 557] <... close resumed>) = 0 [pid 566] <... mmap resumed>) = 0x7f6220445000 [pid 564] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 559] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 568] <... prctl resumed>) = 0 [pid 566] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 564] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 559] <... futex resumed>) = 0 [pid 557] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 566] <... mprotect resumed>) = 0 [pid 564] memfd_create("syzkaller", 0 [pid 566] rt_sigprocmask(SIG_BLOCK, ~[], [pid 564] <... memfd_create resumed>) = 7 [pid 566] <... rt_sigprocmask resumed>[], 8) = 0 [pid 564] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 566] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 564] <... mmap resumed>) = 0x7f620fc64000 [pid 564] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 566] <... clone3 resumed> => {parent_tid=[571]}, 88) = 571 [pid 564] <... write resumed>) = 65536 [pid 558] ioctl(8, LOOP_SET_FD, 7 [pid 566] rt_sigprocmask(SIG_SETMASK, [], [pid 564] munmap(0x7f620fc64000, 65536 [pid 558] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 566] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 564] <... munmap resumed>) = 0 [pid 558] close(8 [pid 557] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] newfstatat(AT_FDCWD, "./11/bus", [pid 568] setpgid(0, 0 [pid 566] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 564] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 558] <... close resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 568] <... setpgid resumed>) = 0 [pid 566] <... futex resumed>) = 0 [pid 564] <... openat resumed>) = 8 [pid 558] close(7 [pid 299] unlink("./11/bus" [pid 568] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 566] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 564] ioctl(8, LOOP_SET_FD, 7 [pid 558] <... close resumed>) = 0 [pid 566] <... futex resumed>) = 0 [pid 564] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 558] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 556] exit_group(0 [pid 299] <... unlink resumed>) = 0 [pid 568] <... openat resumed>) = 3 [pid 566] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 564] ioctl(8, LOOP_CLR_FD [pid 558] <... futex resumed>) = ? [ 25.398297][ T557] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodiscard,barrier,nouid32,grpquota,,errors=continue. Quota mode: writeback. [ 25.414628][ T562] loop4: detected capacity change from 0 to 512 [ 25.416466][ T557] ext4 filesystem being mounted at /root/syzkaller.sY6u5M/10/file0 supports timestamps until 2038 (0x7fffffff) [pid 557] <... futex resumed>) = ? [pid 556] <... exit_group resumed>) = ? [pid 299] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 569] set_robust_list(0x555556cc76a0, 24 [pid 566] <... mmap resumed>) = 0x7f6220424000 [pid 564] <... ioctl resumed>) = 0 [pid 558] +++ exited with 0 +++ [pid 557] +++ exited with 0 +++ [pid 556] +++ exited with 0 +++ [pid 566] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 566] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 566] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[572]}, 88) = 572 [pid 566] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 566] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 566] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 571 attached [pid 571] set_robust_list(0x7f62204659a0, 24) = 0 [pid 571] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 571] memfd_create("syzkaller", 0) = 3 [pid 571] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218024000 [pid 564] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 564] close(8) = 0 [pid 564] close(7) = 0 [pid 564] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 564] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 571] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 571] munmap(0x7f6218024000, 262144) = 0 [pid 571] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 571] ioctl(4, LOOP_SET_FD, 3 [pid 569] <... set_robust_list resumed>) = 0 [pid 568] write(3, "1000", 4 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=556, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 571] <... ioctl resumed>) = 0 [pid 571] close(3) = 0 [pid 571] mkdir("./file0", 0777) = 0 [pid 571] mount("/dev/loop5", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue"./strace-static-x86_64: Process 572 attached [pid 572] set_robust_list(0x7f62204449a0, 24) = 0 [pid 572] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 572] creat("./bus", 000) = 3 [pid 572] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 566] <... futex resumed>) = 0 [pid 566] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 566] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 572] <... futex resumed>) = 1 [pid 572] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 572] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 566] <... futex resumed>) = 0 [pid 566] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 566] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 572] <... futex resumed>) = 1 [pid 572] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 572] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 566] <... futex resumed>) = 0 [pid 566] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 566] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 572] <... futex resumed>) = 1 [pid 572] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE) = 6 [pid 572] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 566] <... futex resumed>) = 0 [pid 566] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 566] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 572] <... futex resumed>) = 1 [pid 572] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0) = 0x20000000 [pid 572] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 566] <... futex resumed>) = 0 [pid 566] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 572] <... futex resumed>) = 1 [pid 569] chdir("./12") = 0 [pid 569] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 569] setpgid(0, 0) = 0 [pid 569] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 569] write(3, "1000", 4) = 4 [pid 569] close(3) = 0 [pid 569] symlink("/dev/binderfs", "./binderfs") = 0 [pid 569] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 569] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 569] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 569] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 569] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 568] <... write resumed>) = 4 [pid 299] newfstatat(AT_FDCWD, "./11/binderfs", [pid 569] <... mprotect resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 568] close(3 [pid 299] unlink("./11/binderfs" [pid 568] <... close resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 568] symlink("/dev/binderfs", "./binderfs" [pid 569] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 568] <... symlink resumed>) = 0 [pid 569] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 572] memfd_create("syzkaller", 0) = 7 [pid 296] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 572] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 568] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] getdents64(3, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 569] <... clone3 resumed> => {parent_tid=[574]}, 88) = 574 [pid 569] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 569] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 569] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 569] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 569] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 569] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 569] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[575]}, 88) = 575 [pid 569] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 569] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 569] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 572] <... mmap resumed>) = 0x7f620fc64000 [pid 568] <... futex resumed>) = 0 [pid 568] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 568] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 568] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 296] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 568] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 296] <... openat resumed>) = 3 [pid 296] newfstatat(3, "", [pid 299] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] close(3 [pid 296] getdents64(3, [pid 568] <... mprotect resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 299] rmdir("./11" [pid 296] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 568] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... rmdir resumed>) = 0 [pid 568] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] mkdir("./12", 0777 [pid 572] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 296] <... umount2 resumed>) = 0 [pid 568] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[576]}, 88) = 576 [pid 568] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 568] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 568] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 568] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 568] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 568] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 568] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[577]}, 88) = 577 [pid 568] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 568] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 568] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 574 attached [pid 574] set_robust_list(0x7f62204659a0, 24) = 0 [pid 574] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 574] memfd_create("syzkaller", 0) = 3 [pid 574] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218024000 [pid 296] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... mkdir resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] newfstatat(AT_FDCWD, "./10/bus", [pid 299] <... openat resumed>) = 3 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 575 attached [pid 572] <... write resumed>) = 65536 [pid 299] ioctl(3, LOOP_CLR_FD [pid 296] unlink("./10/bus"./strace-static-x86_64: Process 577 attached ./strace-static-x86_64: Process 576 attached [pid 575] set_robust_list(0x7f62204449a0, 24 [pid 572] munmap(0x7f620fc64000, 65536 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... unlink resumed>) = 0 [pid 577] set_robust_list(0x7f62204449a0, 24 [pid 576] set_robust_list(0x7f62204659a0, 24 [pid 575] <... set_robust_list resumed>) = 0 [pid 572] <... munmap resumed>) = 0 [pid 299] close(3 [pid 296] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 577] <... set_robust_list resumed>) = 0 [pid 575] rt_sigprocmask(SIG_SETMASK, [], [pid 572] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 299] <... close resumed>) = 0 [pid 577] rt_sigprocmask(SIG_SETMASK, [], [pid 576] <... set_robust_list resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 577] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 576] rt_sigprocmask(SIG_SETMASK, [], [pid 575] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 572] <... openat resumed>) = 8 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] newfstatat(AT_FDCWD, "./10/binderfs", [pid 575] creat("./bus", 000 [pid 572] ioctl(8, LOOP_SET_FD, 7 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 572] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 299] <... clone resumed>, child_tidptr=0x555556cc7690) = 578 [pid 296] unlink("./10/binderfs" [pid 576] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 572] ioctl(8, LOOP_CLR_FD) = 0 [pid 296] <... unlink resumed>) = 0 [pid 296] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 577] creat("./bus", 000) = 3 [pid 575] <... creat resumed>) = 4 [pid 576] memfd_create("syzkaller", 0 [pid 575] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [ 25.460254][ T562] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 25.465023][ T571] loop5: detected capacity change from 0 to 512 [ 25.473823][ T562] EXT4-fs error (device loop4): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # [ 25.489883][ T571] EXT4-fs warning (device loop5): read_mmp_block:115: Error -74 while reading MMP block 12 [ 25.502047][ T562] EXT4-fs (loop4): get orphan inode failed [pid 572] ioctl(8, LOOP_SET_FD, 7 [pid 577] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] <... memfd_create resumed>) = 4 [pid 575] <... futex resumed>) = 1 [pid 572] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 569] <... futex resumed>) = 0 ./strace-static-x86_64: Process 578 attached [pid 577] <... futex resumed>) = 1 [pid 576] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 575] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 574] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 572] close(8 [pid 571] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 569] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 562] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 568] <... futex resumed>) = 0 [pid 568] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 568] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 571] ioctl(4, LOOP_CLR_FD [pid 577] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 576] <... mmap resumed>) = 0x7f6218024000 [pid 575] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 572] <... close resumed>) = 0 [pid 571] <... ioctl resumed>) = 0 [pid 569] <... futex resumed>) = 0 [pid 578] set_robust_list(0x555556cc76a0, 24 [pid 577] <... mount resumed>) = 0 [pid 576] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 265747 [pid 575] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 574] <... write resumed>) = 262144 [pid 572] close(7 [pid 571] close(4 [pid 569] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 562] ioctl(5, LOOP_CLR_FD [pid 578] <... set_robust_list resumed>) = 0 [pid 577] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] <... write resumed>) = 265747 [pid 575] <... mount resumed>) = 0 [pid 572] <... close resumed>) = 0 [pid 571] <... close resumed>) = 0 [pid 578] chdir("./12" [pid 577] <... futex resumed>) = 1 [pid 576] munmap(0x7f6218024000, 265747 [pid 575] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] munmap(0x7f6218024000, 262144 [pid 572] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 571] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 568] <... futex resumed>) = 0 [pid 578] <... chdir resumed>) = 0 [pid 577] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 576] <... munmap resumed>) = 0 [pid 575] <... futex resumed>) = 1 [pid 572] <... futex resumed>) = 0 [pid 571] <... futex resumed>) = 0 [pid 569] <... futex resumed>) = 0 [pid 568] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 578] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 577] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 576] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 575] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 574] <... munmap resumed>) = 0 [pid 572] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 571] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 568] <... futex resumed>) = 0 [pid 566] exit_group(0 [pid 578] <... prctl resumed>) = 0 [pid 577] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 576] <... openat resumed>) = 5 [pid 575] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 574] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 572] <... futex resumed>) = ? [pid 571] <... futex resumed>) = ? [pid 569] <... futex resumed>) = 0 [pid 568] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 566] <... exit_group resumed>) = ? [pid 578] setpgid(0, 0 [pid 577] <... open resumed>) = 6 [ 25.513636][ T562] EXT4-fs (loop4): mount failed [pid 576] ioctl(5, LOOP_SET_FD, 4 [pid 575] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 572] +++ exited with 0 +++ [pid 571] +++ exited with 0 +++ [pid 569] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 566] +++ exited with 0 +++ [pid 578] <... setpgid resumed>) = 0 [pid 577] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] <... openat resumed>) = 5 [pid 562] <... ioctl resumed>) = 0 [pid 574] ioctl(5, LOOP_SET_FD, 3 [pid 578] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 577] <... futex resumed>) = 1 [pid 576] <... ioctl resumed>) = 0 [pid 562] close(5 [pid 578] <... openat resumed>) = 3 [pid 577] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=566, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 578] write(3, "1000", 4 [pid 301] restart_syscall(<... resuming interrupted clone ...> [pid 578] <... write resumed>) = 4 [pid 301] <... restart_syscall resumed>) = 0 [pid 578] close(3) = 0 [pid 578] symlink("/dev/binderfs", "./binderfs" [pid 301] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 578] <... symlink resumed>) = 0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 578] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 578] <... futex resumed>) = 0 [pid 562] <... close resumed>) = 0 [pid 301] <... openat resumed>) = 3 [pid 578] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 562] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] newfstatat(3, "", [pid 578] <... rt_sigaction resumed>NULL, 8) = 0 [pid 562] <... futex resumed>) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 578] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 562] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] getdents64(3, [pid 578] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 576] close(4 [pid 568] <... futex resumed>) = 0 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 578] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 576] <... close resumed>) = 0 [pid 568] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] exit_group(0 [pid 301] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 578] <... mmap resumed>) = 0x7f6220445000 [pid 577] <... futex resumed>) = 0 [pid 576] mkdir("./file0", 0777 [pid 568] <... futex resumed>) = 1 [pid 564] <... futex resumed>) = ? [pid 562] <... futex resumed>) = ? [pid 559] <... exit_group resumed>) = ? [pid 301] <... umount2 resumed>) = 0 [pid 578] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 577] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 576] <... mkdir resumed>) = 0 [pid 568] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 564] +++ exited with 0 +++ [pid 301] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 578] <... mprotect resumed>) = 0 [pid 577] <... socket resumed>) = 4 [pid 576] mount("/dev/loop2", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 578] rt_sigprocmask(SIG_BLOCK, ~[], [pid 577] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] newfstatat(AT_FDCWD, "./11/bus", [pid 578] <... rt_sigprocmask resumed>[], 8) = 0 [pid 577] <... futex resumed>) = 1 [pid 575] <... open resumed>) = 6 [pid 574] <... ioctl resumed>) = 0 [pid 568] <... futex resumed>) = 0 [pid 578] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 577] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 575] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] close(3 [pid 568] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 577] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 575] <... futex resumed>) = 1 [pid 574] <... close resumed>) = 0 [pid 569] <... futex resumed>) = 0 [pid 568] <... futex resumed>) = 0 [pid 301] unlink("./11/bus" [pid 578] <... clone3 resumed> => {parent_tid=[579]}, 88) = 579 [pid 577] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 575] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 574] mkdir("./file0", 0777 [pid 569] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 568] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 579 attached [pid 578] rt_sigprocmask(SIG_SETMASK, [], [pid 577] <... mmap resumed>) = 0x20000000 [pid 575] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 569] <... futex resumed>) = 0 [pid 301] <... unlink resumed>) = 0 [pid 579] set_robust_list(0x7f62204659a0, 24 [pid 578] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 577] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 575] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 574] <... mkdir resumed>) = 0 [pid 569] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 578] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] <... futex resumed>) = 1 [pid 575] <... socket resumed>) = 3 [pid 568] <... futex resumed>) = 0 [pid 301] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 578] <... futex resumed>) = 0 [pid 577] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 575] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] mount("/dev/loop1", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 568] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 579] <... set_robust_list resumed>) = 0 [pid 578] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 575] <... futex resumed>) = 1 [pid 569] <... futex resumed>) = 0 [pid 568] <... futex resumed>) = 0 [pid 301] newfstatat(AT_FDCWD, "./11/binderfs", [pid 579] rt_sigprocmask(SIG_SETMASK, [], [pid 578] <... futex resumed>) = 0 [pid 577] memfd_create("syzkaller", 0 [pid 575] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 578] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 577] <... memfd_create resumed>) = 7 [pid 575] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 569] <... futex resumed>) = 0 [pid 578] <... mmap resumed>) = 0x7f6220424000 [pid 577] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 575] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 579] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 569] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] unlink("./11/binderfs" [pid 579] memfd_create("syzkaller", 0 [pid 578] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 575] <... mmap resumed>) = 0x20000000 [pid 301] <... unlink resumed>) = 0 [pid 579] <... memfd_create resumed>) = 3 [pid 578] <... mprotect resumed>) = 0 [pid 575] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 579] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 578] rt_sigprocmask(SIG_BLOCK, ~[], [pid 575] <... futex resumed>) = 1 [pid 569] <... futex resumed>) = 0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 579] <... mmap resumed>) = 0x7f6218024000 [pid 578] <... rt_sigprocmask resumed>[], 8) = 0 [pid 575] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] newfstatat(AT_FDCWD, "./11/file0", [pid 579] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 578] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 575] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 569] <... futex resumed>) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 579] <... write resumed>) = 262144 [pid 575] memfd_create("syzkaller", 0 [pid 301] umount2("./11/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 578] <... clone3 resumed> => {parent_tid=[580]}, 88) = 580 [pid 575] <... memfd_create resumed>) = 7 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 579] munmap(0x7f6218024000, 262144 [pid 578] rt_sigprocmask(SIG_SETMASK, [], [pid 575] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 301] openat(AT_FDCWD, "./11/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 579] <... munmap resumed>) = 0 [pid 578] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 575] <... mmap resumed>) = 0x7f620fc64000 [pid 301] <... openat resumed>) = 4 [pid 579] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 578] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 575] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 301] newfstatat(4, "", [pid 579] <... openat resumed>) = 4 [pid 578] <... futex resumed>) = 0 [pid 575] <... write resumed>) = 65536 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 579] ioctl(4, LOOP_SET_FD, 3 [pid 578] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 575] munmap(0x7f620fc64000, 65536 [pid 301] getdents64(4, ./strace-static-x86_64: Process 580 attached [pid 579] <... ioctl resumed>) = 0 [pid 577] <... mmap resumed>) = 0x7f620fc65000 [pid 575] <... munmap resumed>) = 0 [pid 562] +++ exited with 0 +++ [pid 559] +++ exited with 0 +++ [pid 301] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 296] <... umount2 resumed>) = 0 [pid 580] set_robust_list(0x7f62204449a0, 24 [pid 579] close(3 [pid 575] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 301] getdents64(4, [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=559, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 580] <... set_robust_list resumed>) = 0 [pid 579] <... close resumed>) = 0 [pid 575] <... openat resumed>) = 8 [pid 301] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 580] rt_sigprocmask(SIG_SETMASK, [], [pid 579] mkdir("./file0", 0777 [pid 575] ioctl(8, LOOP_SET_FD, 7 [pid 301] close(4 [pid 580] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 579] <... mkdir resumed>) = 0 [pid 575] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 301] <... close resumed>) = 0 [pid 300] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] creat("./bus", 000 [pid 579] mount("/dev/loop3", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 575] ioctl(8, LOOP_CLR_FD [pid 301] rmdir("./11/file0" [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] <... creat resumed>) = 3 [pid 577] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 576] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 575] <... ioctl resumed>) = 0 [pid 301] <... rmdir resumed>) = 0 [pid 300] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] <... write resumed>) = 65536 [pid 576] ioctl(5, LOOP_CLR_FD [pid 301] getdents64(3, [pid 300] <... openat resumed>) = 3 [pid 580] <... futex resumed>) = 1 [pid 578] <... futex resumed>) = 0 [pid 577] munmap(0x7f620fc65000, 65536 [pid 576] <... ioctl resumed>) = 0 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 300] newfstatat(3, "", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 578] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] <... munmap resumed>) = 0 [pid 576] close(5 [pid 301] close(3 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] newfstatat(AT_FDCWD, "./10/file0", [pid 580] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 578] <... futex resumed>) = 0 [pid 577] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 576] <... close resumed>) = 0 [pid 575] ioctl(8, LOOP_SET_FD, 7 [pid 301] <... close resumed>) = 0 [pid 300] getdents64(3, [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 580] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 578] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 577] <... openat resumed>) = 5 [pid 576] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 575] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 301] rmdir("./11" [pid 300] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 296] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] <... mount resumed>) = 0 [pid 577] ioctl(5, LOOP_SET_FD, 7 [pid 576] <... futex resumed>) = 0 [pid 575] close(8 [pid 301] <... rmdir resumed>) = 0 [pid 300] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 576] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 575] <... close resumed>) = 0 [pid 301] mkdir("./12", 0777 [pid 300] <... umount2 resumed>) = 0 [pid 296] openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 580] <... futex resumed>) = 1 [pid 578] <... futex resumed>) = 0 [pid 577] ioctl(5, LOOP_CLR_FD [pid 575] close(7 [pid 301] <... mkdir resumed>) = 0 [pid 300] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 578] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] <... ioctl resumed>) = 0 [pid 575] <... close resumed>) = 0 [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... openat resumed>) = 4 [pid 580] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 578] <... futex resumed>) = 0 [pid 575] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... openat resumed>) = 3 [pid 300] newfstatat(AT_FDCWD, "./13/bus", [pid 296] newfstatat(4, "", [pid 580] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 578] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 575] <... futex resumed>) = 0 [pid 301] ioctl(3, LOOP_CLR_FD [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 580] <... open resumed>) = 5 [pid 575] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] unlink("./13/bus" [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 580] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] ioctl(5, LOOP_SET_FD, 7 [pid 301] close(3 [pid 300] <... unlink resumed>) = 0 [pid 296] getdents64(4, [pid 580] <... futex resumed>) = 1 [pid 578] <... futex resumed>) = 0 [pid 577] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 301] <... close resumed>) = 0 [pid 300] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 578] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] close(5 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 580] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 578] <... futex resumed>) = 0 [pid 577] <... close resumed>) = 0 [pid 300] newfstatat(AT_FDCWD, "./13/binderfs", [pid 580] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 578] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 577] close(7 [pid 301] <... clone resumed>, child_tidptr=0x555556cc7690) = 583 [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] getdents64(4, [pid 580] <... socket resumed>) = 6 [pid 577] <... close resumed>) = 0 [pid 300] unlink("./13/binderfs" [pid 296] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 580] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... unlink resumed>) = 0 [pid 296] close(4 [pid 580] <... futex resumed>) = 1 [pid 578] <... futex resumed>) = 0 [pid 577] <... futex resumed>) = 0 [pid 300] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 578] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 568] exit_group(0 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... close resumed>) = 0 [pid 580] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 578] <... futex resumed>) = 0 [pid 577] <... futex resumed>) = ? [pid 576] <... futex resumed>) = ? [pid 568] <... exit_group resumed>) = ? [pid 300] newfstatat(AT_FDCWD, "./13/file0", [pid 296] rmdir("./10/file0" [pid 580] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 578] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 577] +++ exited with 0 +++ [pid 576] +++ exited with 0 +++ [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 25.535678][ T576] loop2: detected capacity change from 0 to 519 [ 25.536287][ T574] loop1: detected capacity change from 0 to 512 [ 25.557712][ T576] EXT4-fs warning (device loop2): read_mmp_block:115: Error -74 while reading MMP block 12 [ 25.566663][ T579] loop3: detected capacity change from 0 to 512 [ 25.569293][ T574] EXT4-fs warning (device loop1): read_mmp_block:115: Error -74 while reading MMP block 12 [pid 580] <... mmap resumed>) = 0x20000000 [pid 300] umount2("./13/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] <... futex resumed>) = 1 [pid 578] <... futex resumed>) = 0 [pid 300] openat(AT_FDCWD, "./13/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... rmdir resumed>) = 0 [pid 580] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 578] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... openat resumed>) = 4 [pid 580] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 578] <... futex resumed>) = 0 [pid 300] newfstatat(4, "", [pid 296] getdents64(3, [pid 580] memfd_create("syzkaller", 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 580] <... memfd_create resumed>) = 7 [pid 300] getdents64(4, [pid 296] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 580] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 580] <... mmap resumed>) = 0x7f620fc64000 [pid 300] getdents64(4, [pid 296] close(3 [pid 580] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 296] <... close resumed>) = 0 [pid 580] <... write resumed>) = 65536 [pid 300] close(4 [pid 580] munmap(0x7f620fc64000, 65536 [pid 300] <... close resumed>) = 0 ./strace-static-x86_64: Process 583 attached [pid 300] rmdir("./13/file0" [pid 583] set_robust_list(0x555556cc76a0, 24 [pid 300] <... rmdir resumed>) = 0 [pid 296] rmdir("./10" [pid 583] <... set_robust_list resumed>) = 0 [pid 300] getdents64(3, [pid 583] chdir("./12" [pid 568] +++ exited with 0 +++ [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 583] <... chdir resumed>) = 0 [pid 300] close(3 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=568, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 296] <... rmdir resumed>) = 0 [pid 583] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 300] <... close resumed>) = 0 [pid 296] mkdir("./11", 0777 [pid 583] <... prctl resumed>) = 0 [pid 300] rmdir("./13" [pid 583] setpgid(0, 0 [pid 580] <... munmap resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 298] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... mkdir resumed>) = 0 [pid 583] <... setpgid resumed>) = 0 [pid 580] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 300] mkdir("./14", 0777 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 583] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 580] <... openat resumed>) = 8 [pid 300] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... openat resumed>) = 3 [pid 583] <... openat resumed>) = 3 [pid 580] ioctl(8, LOOP_SET_FD, 7 [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 298] <... openat resumed>) = 3 [pid 296] ioctl(3, LOOP_CLR_FD [pid 583] write(3, "1000", 4 [pid 580] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 300] <... openat resumed>) = 3 [pid 298] newfstatat(3, "", [pid 583] <... write resumed>) = 4 [pid 580] ioctl(8, LOOP_CLR_FD [pid 300] ioctl(3, LOOP_CLR_FD [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 583] close(3 [pid 580] <... ioctl resumed>) = 0 [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] getdents64(3, [pid 583] <... close resumed>) = 0 [pid 300] close(3 [pid 298] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 296] close(3 [pid 583] symlink("/dev/binderfs", "./binderfs" [pid 300] <... close resumed>) = 0 [pid 298] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 583] <... symlink resumed>) = 0 [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... close resumed>) = 0 [pid 583] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 583] <... futex resumed>) = 0 [pid 580] ioctl(8, LOOP_SET_FD, 7 [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 584 [pid 298] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 583] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 580] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 583] <... rt_sigaction resumed>NULL, 8) = 0 [pid 580] close(8 [pid 298] newfstatat(AT_FDCWD, "./10/bus", [pid 583] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 580] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 583] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 580] close(7 [pid 298] unlink("./10/bus" [pid 583] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 580] <... close resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 583] <... mmap resumed>) = 0x7f6220445000 [pid 580] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 583] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 580] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 583] <... mprotect resumed>) = 0 [pid 580] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] newfstatat(AT_FDCWD, "./10/binderfs", [pid 583] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 583] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] unlink("./10/binderfs" [pid 583] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 584 attached [pid 583] <... clone3 resumed> => {parent_tid=[585]}, 88) = 585 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 584] set_robust_list(0x555556cc76a0, 24 [pid 583] rt_sigprocmask(SIG_SETMASK, [], [pid 298] newfstatat(AT_FDCWD, "./10/file0", [pid 584] <... set_robust_list resumed>) = 0 [pid 583] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 584] chdir("./14" [pid 583] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./10/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 584] <... chdir resumed>) = 0 [pid 583] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 584] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 583] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] openat(AT_FDCWD, "./10/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 584] <... prctl resumed>) = 0 [pid 583] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 584] setpgid(0, 0 [pid 583] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] newfstatat(4, "", [pid 584] <... setpgid resumed>) = 0 [pid 583] <... mmap resumed>) = 0x7f6220424000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 584] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 583] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 298] getdents64(4, [pid 584] <... openat resumed>) = 3 [pid 583] <... mprotect resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 584] write(3, "1000", 4 [pid 583] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] getdents64(4, [pid 584] <... write resumed>) = 4 [pid 583] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 584] close(3 [pid 583] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 298] close(4 [pid 584] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 583] <... clone3 resumed> => {parent_tid=[586]}, 88) = 586 [pid 298] rmdir("./10/file0" [pid 296] <... clone resumed>, child_tidptr=0x555556cc7690) = 587 [pid 583] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 587 attached ./strace-static-x86_64: Process 586 attached ./strace-static-x86_64: Process 585 attached [pid 584] symlink("/dev/binderfs", "./binderfs" [pid 583] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 574] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 298] getdents64(3, [pid 587] set_robust_list(0x555556cc76a0, 24 [pid 586] set_robust_list(0x7f62204449a0, 24 [pid 585] set_robust_list(0x7f62204659a0, 24 [pid 584] <... symlink resumed>) = 0 [pid 583] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] ioctl(5, LOOP_CLR_FD [pid 298] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 587] <... set_robust_list resumed>) = 0 [pid 586] <... set_robust_list resumed>) = 0 [pid 585] <... set_robust_list resumed>) = 0 [pid 584] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 583] <... futex resumed>) = 0 [pid 574] <... ioctl resumed>) = 0 [pid 298] close(3 [pid 587] chdir("./11" [pid 586] rt_sigprocmask(SIG_SETMASK, [], [pid 585] rt_sigprocmask(SIG_SETMASK, [], [pid 584] <... futex resumed>) = 0 [pid 583] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 574] close(5 [pid 298] <... close resumed>) = 0 [pid 587] <... chdir resumed>) = 0 [pid 586] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 585] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 584] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 587] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 586] creat("./bus", 000 [pid 585] memfd_create("syzkaller", 0 [pid 574] <... close resumed>) = 0 [pid 584] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] rmdir("./10" [pid 587] <... prctl resumed>) = 0 [pid 586] <... creat resumed>) = 3 [pid 585] <... memfd_create resumed>) = 4 [pid 584] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 574] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 587] setpgid(0, 0 [pid 586] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 585] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 587] <... setpgid resumed>) = 0 [pid 586] <... futex resumed>) = 1 [pid 585] <... mmap resumed>) = 0x7f6218024000 [pid 583] <... futex resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 587] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 586] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 585] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 584] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 583] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] <... futex resumed>) = 0 [pid 298] mkdir("./11", 0777 [pid 587] <... openat resumed>) = 3 [pid 586] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 585] <... write resumed>) = 262144 [pid 584] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 583] <... futex resumed>) = 0 [pid 579] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 574] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] exit_group(0 [pid 587] write(3, "1000", 4 [pid 586] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 585] munmap(0x7f6218024000, 262144 [pid 587] <... write resumed>) = 4 [pid 586] <... mount resumed>) = 0 [pid 585] <... munmap resumed>) = 0 [pid 584] <... mmap resumed>) = 0x7f6220445000 [pid 583] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 579] ioctl(4, LOOP_CLR_FD [pid 575] <... futex resumed>) = ? [pid 574] <... futex resumed>) = ? [pid 569] <... exit_group resumed>) = ? [pid 298] <... mkdir resumed>) = 0 [pid 587] close(3 [pid 586] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 585] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 587] <... close resumed>) = 0 [pid 586] <... futex resumed>) = 0 [pid 585] <... openat resumed>) = 5 [pid 579] <... ioctl resumed>) = 0 [ 25.620215][ T579] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 25.637186][ T579] EXT4-fs error (device loop3): ext4_init_orphan_info:586: comm syz-executor172: inode #0: comm syz-executor172: iget: illegal inode # [ 25.653736][ T579] EXT4-fs (loop3): get orphan inode failed [ 25.665517][ T579] EXT4-fs (loop3): mount failed [pid 587] symlink("/dev/binderfs", "./binderfs" [pid 586] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 585] ioctl(5, LOOP_SET_FD, 4 [pid 587] <... symlink resumed>) = 0 [pid 584] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 583] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 579] close(4 [pid 575] +++ exited with 0 +++ [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 587] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 579] <... close resumed>) = 0 [pid 587] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 579] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 587] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 579] <... futex resumed>) = 0 [pid 587] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 579] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 578] exit_group(0 [pid 583] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 587] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 584] <... mprotect resumed>) = 0 [pid 586] <... futex resumed>) = 0 [pid 583] <... futex resumed>) = 1 [pid 580] <... futex resumed>) = ? [pid 579] <... futex resumed>) = ? [pid 578] <... exit_group resumed>) = ? [pid 298] <... openat resumed>) = 3 [pid 587] <... mprotect resumed>) = 0 [pid 586] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 584] rt_sigprocmask(SIG_BLOCK, ~[], [pid 587] rt_sigprocmask(SIG_BLOCK, ~[], [pid 586] <... open resumed>) = 6 [pid 585] <... ioctl resumed>) = 0 [pid 584] <... rt_sigprocmask resumed>[], 8) = 0 [pid 583] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 580] +++ exited with 0 +++ [pid 298] ioctl(3, LOOP_CLR_FD [pid 587] <... rt_sigprocmask resumed>[], 8) = 0 [pid 586] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 583] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 587] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 586] <... futex resumed>) = 0 [pid 583] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 586] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 584] <... clone3 resumed> => {parent_tid=[588]}, 88) = 588 [pid 583] <... futex resumed>) = 0 [pid 587] <... clone3 resumed> => {parent_tid=[589]}, 88) = 589 [pid 586] <... socket resumed>) = 7 [pid 584] rt_sigprocmask(SIG_SETMASK, [], [pid 583] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... close resumed>) = 0 [pid 587] rt_sigprocmask(SIG_SETMASK, [], [pid 586] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 583] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 587] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 586] <... futex resumed>) = 0 [pid 587] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 586] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 587] <... futex resumed>) = 0 [pid 587] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 587] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 587] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 583] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 587] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 587] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[591]}, 88) = 591 [pid 586] <... futex resumed>) = 0 [pid 583] <... futex resumed>) = 1 [pid 584] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 590 [pid 587] rt_sigprocmask(SIG_SETMASK, [], [pid 586] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 584] <... futex resumed>) = 0 [pid 583] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 591 attached ./strace-static-x86_64: Process 589 attached ./strace-static-x86_64: Process 588 attached [pid 587] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 586] <... mmap resumed>) = 0x20000000 [pid 585] close(4 [pid 584] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 587] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 586] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] <... futex resumed>) = 0 [pid 587] <... futex resumed>) = 0 [pid 586] <... futex resumed>) = 1 [pid 584] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 583] <... futex resumed>) = 0 [pid 587] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 586] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 584] <... mmap resumed>) = 0x7f6220424000 [pid 583] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 586] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 584] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 583] <... futex resumed>) = 0 [pid 588] set_robust_list(0x7f62204659a0, 24) = 0 [pid 588] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 588] memfd_create("syzkaller", 0 [pid 589] set_robust_list(0x7f62204659a0, 24 [pid 588] <... memfd_create resumed>) = 3 [pid 589] <... set_robust_list resumed>) = 0 [pid 589] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 584] <... mprotect resumed>) = 0 [pid 585] <... close resumed>) = 0 [pid 584] rt_sigprocmask(SIG_BLOCK, ~[], [pid 586] memfd_create("syzkaller", 0 [pid 584] <... rt_sigprocmask resumed>[], 8) = 0 [pid 589] memfd_create("syzkaller", 0 [pid 586] <... memfd_create resumed>) = 4 [pid 584] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 586] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 585] mkdir(0x20000000, 0777./strace-static-x86_64: Process 592 attached ./strace-static-x86_64: Process 590 attached [pid 586] <... mmap resumed>) = 0x7f620fc64000 [pid 585] <... mkdir resumed>) = 0 [pid 588] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218024000 [pid 588] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 589] <... memfd_create resumed>) = 3 [pid 589] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6218024000 [pid 589] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 586] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 584] <... clone3 resumed> => {parent_tid=[592]}, 88) = 592 [pid 591] set_robust_list(0x7f62204449a0, 24) = 0 [pid 591] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 591] creat("./bus", 000) = 4 [pid 585] mount("/dev/loop5", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"...) = -1 ENODEV (No such device) [pid 585] ioctl(5, LOOP_CLR_FD) = 0 [pid 585] close(5 [pid 591] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 585] <... close resumed>) = 0 [pid 591] <... futex resumed>) = 1 [pid 587] <... futex resumed>) = 0 [pid 585] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 591] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 587] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 591] <... mount resumed>) = 0 [pid 587] <... futex resumed>) = 0 [pid 585] <... futex resumed>) = 0 [pid 591] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 587] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 591] <... futex resumed>) = 0 [pid 587] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 585] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 591] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 587] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 591] <... open resumed>) = 5 [pid 587] <... futex resumed>) = 0 [pid 591] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 587] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 584] rt_sigprocmask(SIG_SETMASK, [], [pid 592] set_robust_list(0x7f62204449a0, 24 [pid 591] <... futex resumed>) = 0 [pid 590] set_robust_list(0x555556cc76a0, 24 [pid 588] <... write resumed>) = 262144 [pid 587] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 586] <... write resumed>) = 65536 [pid 584] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 592] <... set_robust_list resumed>) = 0 [pid 591] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 590] <... set_robust_list resumed>) = 0 [pid 587] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 586] munmap(0x7f620fc64000, 65536 [pid 584] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] +++ exited with 0 +++ [pid 569] +++ exited with 0 +++ [pid 592] rt_sigprocmask(SIG_SETMASK, [], [pid 591] <... socket resumed>) = 6 [pid 590] chdir("./11" [pid 589] <... write resumed>) = 262144 [pid 588] munmap(0x7f6218024000, 262144 [pid 587] <... futex resumed>) = 0 [pid 586] <... munmap resumed>) = 0 [pid 592] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 591] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] <... chdir resumed>) = 0 [pid 589] munmap(0x7f6218024000, 262144 [pid 588] <... munmap resumed>) = 0 [pid 587] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 586] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 584] <... futex resumed>) = 0 [pid 592] creat("./bus", 000 [pid 591] <... futex resumed>) = 0 [pid 590] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 589] <... munmap resumed>) = 0 [pid 588] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 587] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 586] <... openat resumed>) = 5 [pid 584] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=569, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 591] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 589] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 588] <... openat resumed>) = 4 [pid 587] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 586] ioctl(5, LOOP_SET_FD, 4 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 591] <... mmap resumed>) = 0x20000000 [pid 589] <... openat resumed>) = 7 [pid 588] ioctl(4, LOOP_SET_FD, 3 [pid 587] <... futex resumed>) = 0 [pid 586] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 297] <... restart_syscall resumed>) = 0 [pid 592] <... creat resumed>) = 5 [pid 591] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] <... prctl resumed>) = 0 [pid 587] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 586] ioctl(5, LOOP_CLR_FD [pid 592] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] setpgid(0, 0 [pid 586] <... ioctl resumed>) = 0 [pid 592] <... futex resumed>) = 1 [pid 590] <... setpgid resumed>) = 0 [pid 584] <... futex resumed>) = 0 [pid 297] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 592] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 590] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 584] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 592] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 590] <... openat resumed>) = 3 [pid 584] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 592] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 590] write(3, "1000", 4 [pid 584] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... openat resumed>) = 3 [pid 592] <... mount resumed>) = 0 [pid 590] <... write resumed>) = 4 [pid 586] ioctl(5, LOOP_SET_FD, 4 [pid 297] newfstatat(3, "", [pid 592] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] close(3 [pid 586] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 592] <... futex resumed>) = 1 [pid 590] <... close resumed>) = 0 [pid 586] close(5 [pid 584] <... futex resumed>) = 0 [pid 297] getdents64(3, [pid 592] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 590] symlink("/dev/binderfs", "./binderfs" [pid 586] <... close resumed>) = 0 [pid 584] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 592] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 590] <... symlink resumed>) = 0 [pid 586] close(4 [pid 584] <... futex resumed>) = 0 [pid 297] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 592] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 591] <... futex resumed>) = 0 [pid 590] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 589] ioctl(7, LOOP_SET_FD, 3 [pid 588] <... ioctl resumed>) = 0 [pid 587] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 586] <... close resumed>) = 0 [pid 584] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 592] <... open resumed>) = 6 [pid 591] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 590] <... futex resumed>) = 0 [pid 586] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = 0 [pid 592] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 586] <... futex resumed>) = 0 [pid 297] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 592] <... futex resumed>) = 1 [pid 590] <... rt_sigaction resumed>NULL, 8) = 0 [pid 586] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 584] <... futex resumed>) = 0 [pid 583] exit_group(0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 592] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 590] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 586] <... futex resumed>) = ? [pid 584] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 583] <... exit_group resumed>) = ? [pid 297] newfstatat(AT_FDCWD, "./12/bus", [pid 592] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 590] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 586] +++ exited with 0 +++ [pid 584] <... futex resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 592] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 590] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 584] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] unlink("./12/bus" [pid 592] <... socket resumed>) = 7 [pid 590] <... mmap resumed>) = 0x7f6220445000 [pid 297] <... unlink resumed>) = 0 [pid 592] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 297] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 592] <... futex resumed>) = 1 [pid 590] <... mprotect resumed>) = 0 [pid 584] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 592] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 591] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 590] rt_sigprocmask(SIG_BLOCK, ~[], [pid 587] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] newfstatat(AT_FDCWD, "./12/binderfs", [pid 592] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 590] <... rt_sigprocmask resumed>[], 8) = 0 [pid 585] <... futex resumed>) = ? [pid 584] <... futex resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 592] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 6, 0 [pid 590] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 584] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] unlink("./12/binderfs" [pid 592] <... mmap resumed>) = 0x20000000 [pid 297] <... unlink resumed>) = 0 [pid 592] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] <... clone3 resumed> => {parent_tid=[593]}, 88) = 593 [pid 297] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 592] <... futex resumed>) = 1 [pid 590] rt_sigprocmask(SIG_SETMASK, [], [pid 584] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 592] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 590] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 584] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] newfstatat(AT_FDCWD, "./12/file0", [pid 592] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 590] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] <... futex resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 592] memfd_create("syzkaller", 0 [pid 590] <... futex resumed>) = 0 [pid 297] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 592] <... memfd_create resumed>) = 8 [pid 590] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 592] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 590] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 592] <... mmap resumed>) = 0x7f620fc64000 [pid 590] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... openat resumed>) = 4 [pid 592] write(8, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 590] <... mmap resumed>) = 0x7f6220424000 [pid 297] newfstatat(4, "", [pid 592] <... write resumed>) = 65536 [pid 590] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 592] munmap(0x7f620fc64000, 65536 [pid 590] <... mprotect resumed>) = 0 [pid 297] getdents64(4, [pid 592] <... munmap resumed>) = 0 [pid 590] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 592] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 590] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] getdents64(4, [pid 592] <... openat resumed>) = 9 [pid 590] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 297] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 592] ioctl(9, LOOP_SET_FD, 8 [pid 297] close(4 [pid 592] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 590] <... clone3 resumed> => {parent_tid=[594]}, 88) = 594 [pid 297] <... close resumed>) = 0 [pid 592] ioctl(9, LOOP_CLR_FD [pid 590] rt_sigprocmask(SIG_SETMASK, [], [pid 297] rmdir("./12/file0" [pid 592] <... ioctl resumed>) = 0 [pid 590] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 590] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] getdents64(3, [pid 590] <... futex resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 593 attached [pid 590] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] close(3 [pid 593] set_robust_list(0x7f62204659a0, 24 [pid 297] <... close resumed>) = 0 [pid 593] <... set_robust_list resumed>) = 0 [pid 297] rmdir("./12" [pid 593] rt_sigprocmask(SIG_SETMASK, [], [pid 592] ioctl(9, LOOP_SET_FD, 8 [pid 587] <... futex resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 593] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 592] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 297] mkdir("./13", 0777./strace-static-x86_64: Process 594 attached [pid 593] memfd_create("syzkaller", 0 [pid 592] close(9 [pid 589] <... ioctl resumed>) = 0 [pid 588] close(3 [pid 297] <... mkdir resumed>) = 0 [pid 594] set_robust_list(0x7f62204449a0, 24 [pid 593] <... memfd_create resumed>) = 3 [pid 592] <... close resumed>) = 0 [pid 591] memfd_create("syzkaller", 0 [pid 589] close(3 [pid 588] <... close resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 594] <... set_robust_list resumed>) = 0 [pid 592] close(8 [pid 589] <... close resumed>) = 0 [pid 588] mkdir(0x20000000, 0777 [pid 594] rt_sigprocmask(SIG_SETMASK, [], [pid 593] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 592] <... close resumed>) = 0 [pid 591] <... memfd_create resumed>) = 3 [pid 589] mkdir(0x20000000, 0777 [pid 588] <... mkdir resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 594] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 593] <... mmap resumed>) = 0x7f6218024000 [pid 592] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 591] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 589] <... mkdir resumed>) = 0 [pid 588] mount("/dev/loop4", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 297] ioctl(3, LOOP_CLR_FD [pid 594] creat("./bus", 000 [pid 592] <... futex resumed>) = 0 [pid 591] <... mmap resumed>) = 0x7f620fc64000 [pid 589] mount("/dev/loop0", 0x20000000, 0x200005c0, MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"... [pid 588] <... mount resumed>) = -1 ENODEV (No such device) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 594] <... creat resumed>) = 4 [pid 592] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 589] <... mount resumed>) = -1 ENODEV (No such device) [pid 588] ioctl(4, LOOP_CLR_FD [pid 297] close(3 [pid 594] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 589] ioctl(7, LOOP_CLR_FD [pid 588] <... ioctl resumed>) = 0 [pid 594] <... futex resumed>) = 1 [pid 590] <... futex resumed>) = 0 [pid 589] <... ioctl resumed>) = 0 [pid 588] close(4 [pid 297] <... close resumed>) = 0 [pid 594] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 590] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 589] close(7 [pid 588] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 594] <... mount resumed>) = 0 [pid 591] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 590] <... futex resumed>) = 0 [pid 589] <... close resumed>) = 0 [pid 588] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 589] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] <... futex resumed>) = 0 [pid 594] <... futex resumed>) = 0 [pid 589] <... futex resumed>) = 0 [pid 588] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 594] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 589] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 590] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] <... clone resumed>, child_tidptr=0x555556cc7690) = 595 [pid 590] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 584] exit_group(0 [pid 594] <... futex resumed>) = 0 [pid 592] <... futex resumed>) = ? [pid 590] <... futex resumed>) = 1 [pid 588] <... futex resumed>) = ? [pid 584] <... exit_group resumed>) = ? [pid 594] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 592] +++ exited with 0 +++ [pid 590] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 588] +++ exited with 0 +++ [pid 594] <... open resumed>) = 5 [pid 594] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 594] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 595 attached [pid 595] set_robust_list(0x555556cc76a0, 24) = 0 [pid 595] chdir("./13") = 0 [pid 590] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 595] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 595] setpgid(0, 0) = 0 [pid 595] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 590] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] <... futex resumed>) = 0 [pid 591] <... write resumed>) = 65536 [pid 590] <... futex resumed>) = 1 [pid 594] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 590] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 591] munmap(0x7f620fc64000, 65536 [pid 594] <... socket resumed>) = 6 [pid 593] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 594] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 591] <... munmap resumed>) = 0 [pid 594] <... futex resumed>) = 1 [pid 590] <... futex resumed>) = 0 [pid 594] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 591] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 590] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 594] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 590] <... futex resumed>) = 0 [pid 594] <... mmap resumed>) = 0x20000000 [pid 594] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 590] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 594] <... futex resumed>) = 0 [pid 590] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 595] <... openat resumed>) = 3 [pid 594] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 591] <... openat resumed>) = 7 [pid 590] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 595] write(3, "1000", 4 [pid 594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 590] <... futex resumed>) = 0 [pid 591] ioctl(7, LOOP_SET_FD, 3 [pid 595] <... write resumed>) = 4 [pid 594] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 590] stat(NULL, [pid 595] close(3 [pid 591] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 595] <... close resumed>) = 0 [pid 591] ioctl(7, LOOP_CLR_FD [pid 595] symlink("/dev/binderfs", "./binderfs" [pid 593] <... write resumed>) = ? [pid 591] <... ioctl resumed>) = 0 [pid 595] <... symlink resumed>) = 0 [pid 593] +++ killed by SIGBUS +++ [pid 595] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] +++ killed by SIGBUS +++ [pid 590] +++ killed by SIGBUS +++ [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=590, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 595] <... futex resumed>) = 0 [pid 298] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 595] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 595] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 579] +++ exited with 0 +++ [pid 578] +++ exited with 0 +++ [pid 595] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 595] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 595] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 595] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 595] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[596]}, 88) = 596 [pid 595] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 595] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 595] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 595] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 595] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 595] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 595] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[597]}, 88) = 597 [pid 595] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 595] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 595] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 597 attached [pid 597] set_robust_list(0x7f62204449a0, 24) = 0 [pid 597] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 597] creat("./bus", 000) = 3 [pid 597] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 595] <... futex resumed>) = 0 [pid 595] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 595] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 597] <... futex resumed>) = 1 [pid 597] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 597] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 595] <... futex resumed>) = 0 [pid 595] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 595] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 597] <... futex resumed>) = 1 [pid 597] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 597] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 595] <... futex resumed>) = 0 [pid 595] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 595] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 597] <... futex resumed>) = 1 [pid 597] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE) = 5 [pid 597] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 595] <... futex resumed>) = 0 [pid 595] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 595] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 597] <... futex resumed>) = 1 [pid 597] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0) = 0x20000000 [pid 597] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 595] <... futex resumed>) = 0 [pid 595] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 597] <... futex resumed>) = 1 [pid 597] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- ./strace-static-x86_64: Process 596 attached [pid 597] +++ killed by SIGBUS +++ [pid 596] +++ killed by SIGBUS +++ [pid 595] +++ killed by SIGBUS +++ [pid 298] <... openat resumed>) = 3 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=595, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=578, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 298] newfstatat(3, "", [pid 591] ioctl(7, LOOP_SET_FD, 3 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 591] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] getdents64(3, [pid 591] close(7 [pid 299] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 585] +++ exited with 0 +++ [pid 584] +++ exited with 0 +++ [pid 583] +++ exited with 0 +++ [pid 299] <... openat resumed>) = 3 [pid 298] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 297] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 301] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=583, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 300] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=584, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 298] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] newfstatat(3, "", [pid 297] <... openat resumed>) = 3 [pid 591] <... close resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 297] newfstatat(3, "", [pid 591] close(3 [pid 301] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] getdents64(3, [pid 298] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 136 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] getdents64(3, [pid 300] openat(AT_FDCWD, "./14", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] newfstatat(AT_FDCWD, "./11/bus", [pid 301] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... getdents64 resumed>0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 300] <... openat resumed>) = 3 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] <... openat resumed>) = 3 [pid 300] newfstatat(3, "", [pid 299] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] unlink("./11/bus" [pid 297] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 301] newfstatat(3, "", [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 300] getdents64(3, [pid 298] <... unlink resumed>) = 0 [pid 301] getdents64(3, [pid 299] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 128 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 5 entries */, 32768) = 128 [pid 299] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 301] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./12/bus", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 301] <... umount2 resumed>) = 0 [pid 300] <... umount2 resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./14/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] unlink("./12/bus" [pid 298] newfstatat(AT_FDCWD, "./11/binderfs", [pid 297] newfstatat(AT_FDCWD, "./13/bus", [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 25.676727][ T585] loop5: detected capacity change from 0 to 512 [ 25.700624][ T588] loop4: detected capacity change from 0 to 512 [ 25.707472][ T589] loop0: detected capacity change from 0 to 512 [ 25.714480][ T591] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 31 prio class 0 [pid 591] <... close resumed>) = 0 [pid 301] newfstatat(AT_FDCWD, "./12/bus", [pid 300] newfstatat(AT_FDCWD, "./14/bus", [pid 299] <... unlink resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 591] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] unlink("./11/binderfs" [pid 297] unlink("./13/bus" [pid 591] <... futex resumed>) = 0 [pid 587] exit_group(0 [pid 301] unlink("./12/bus" [pid 300] unlink("./14/bus" [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... unlink resumed>) = 0 [pid 589] <... futex resumed>) = ? [pid 587] <... exit_group resumed>) = ? [pid 297] <... unlink resumed>) = 0 [pid 589] +++ exited with 0 +++ [pid 301] <... unlink resumed>) = 0 [pid 300] <... unlink resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./12/binderfs", [pid 298] getdents64(3, [pid 301] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./14/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] unlink("./12/binderfs" [pid 298] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 301] newfstatat(AT_FDCWD, "./12/binderfs", [pid 300] newfstatat(AT_FDCWD, "./14/binderfs", [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 301] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] <... unlink resumed>) = 0 [pid 298] close(3 [pid 297] newfstatat(AT_FDCWD, "./13/binderfs", [pid 301] unlink("./12/binderfs" [pid 300] unlink("./14/binderfs" [pid 299] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... close resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 301] <... unlink resumed>) = 0 [pid 300] <... unlink resumed>) = 0 [pid 298] rmdir("./11" [pid 297] unlink("./13/binderfs" [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 301] umount2("./12/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./14/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... rmdir resumed>) = 0 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./12/file0", [pid 297] <... unlink resumed>) = 0 [pid 298] mkdir("./12", 0777 [pid 301] newfstatat(AT_FDCWD, "./12/ext4", [pid 300] newfstatat(AT_FDCWD, "./14/ext4", [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] getdents64(3, [pid 298] <... mkdir resumed>) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] umount2("./12/file0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 297] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 301] umount2("./12/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 300] umount2("./14/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... openat resumed>) = 3 [pid 301] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 300] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./12/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] ioctl(3, LOOP_CLR_FD [pid 297] close(3 [pid 301] openat(AT_FDCWD, "./12/ext4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 300] openat(AT_FDCWD, "./14/ext4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... openat resumed>) = 4 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 301] <... openat resumed>) = 4 [pid 300] <... openat resumed>) = 4 [pid 299] newfstatat(4, "", [pid 298] close(3 [pid 297] <... close resumed>) = 0 [pid 301] newfstatat(4, "", [pid 300] newfstatat(4, "", [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 301] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 300] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... close resumed>) = 0 [pid 297] rmdir("./13" [pid 299] getdents64(4, [pid 301] getdents64(4, [pid 300] getdents64(4, [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 598 attached [pid 301] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 299] <... getdents64 resumed>0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 297] <... rmdir resumed>) = 0 [pid 301] getdents64(4, [pid 300] getdents64(4, [pid 299] getdents64(4, [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 598 [pid 297] mkdir("./14", 0777 [pid 301] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 300] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 299] <... getdents64 resumed>0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 301] close(4 [pid 300] close(4 [pid 299] close(4 [pid 297] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 301] <... close resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 301] rmdir("./12/ext4" [pid 300] rmdir("./14/ext4" [pid 299] rmdir("./12/file0" [pid 297] ioctl(3, LOOP_CLR_FD [pid 301] <... rmdir resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 301] getdents64(3, [pid 300] getdents64(3, [pid 299] getdents64(3, [pid 297] close(3 [pid 598] set_robust_list(0x555556cc76a0, 24 [pid 301] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 300] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 299] <... getdents64 resumed>0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 297] <... close resumed>) = 0 [pid 598] <... set_robust_list resumed>) = 0 [pid 301] close(3 [pid 300] close(3 [pid 299] close(3 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 598] chdir("./12" [pid 301] <... close resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 598] <... chdir resumed>) = 0 [pid 301] rmdir("./12" [pid 300] rmdir("./14" [pid 299] rmdir("./12" [pid 297] <... clone resumed>, child_tidptr=0x555556cc7690) = 599 [pid 598] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 301] <... rmdir resumed>) = 0 [pid 300] <... rmdir resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 598] <... prctl resumed>) = 0 [pid 301] mkdir("./13", 0777 [pid 300] mkdir("./15", 0777 [pid 299] mkdir("./13", 0777./strace-static-x86_64: Process 599 attached [pid 598] setpgid(0, 0 [pid 301] <... mkdir resumed>) = 0 [pid 300] <... mkdir resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 598] <... setpgid resumed>) = 0 [pid 301] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 300] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 299] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 599] set_robust_list(0x555556cc76a0, 24 [pid 598] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 301] <... openat resumed>) = 3 [pid 300] <... openat resumed>) = 3 [pid 299] <... openat resumed>) = 3 [pid 598] <... openat resumed>) = 3 [pid 301] ioctl(3, LOOP_CLR_FD [pid 300] ioctl(3, LOOP_CLR_FD [pid 299] ioctl(3, LOOP_CLR_FD [pid 598] write(3, "1000", 4 [pid 301] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 300] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 598] <... write resumed>) = 4 [pid 301] close(3 [pid 300] close(3 [pid 299] close(3 [pid 598] close(3 [pid 301] <... close resumed>) = 0 [pid 300] <... close resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 598] <... close resumed>) = 0 [pid 301] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 300] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 601 attached ./strace-static-x86_64: Process 600 attached [pid 599] <... set_robust_list resumed>) = 0 [pid 598] symlink("/dev/binderfs", "./binderfs") = 0 [pid 301] <... clone resumed>, child_tidptr=0x555556cc7690) = 600 [pid 300] <... clone resumed>, child_tidptr=0x555556cc7690) = 601 [pid 299] <... clone resumed>, child_tidptr=0x555556cc7690) = 602 [pid 598] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 598] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, NULL, 8) = 0 [pid 598] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 598] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220445000 [pid 598] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 598] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 598] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} => {parent_tid=[603]}, 88) = 603 [pid 598] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 598] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 598] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 598] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6220424000 [pid 598] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 598] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 598] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} => {parent_tid=[604]}, 88) = 604 [pid 598] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 598] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 598] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 604 attached [pid 604] set_robust_list(0x7f62204449a0, 24) = 0 [pid 604] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 604] creat("./bus", 000 [pid 599] chdir("./14" [pid 600] set_robust_list(0x555556cc76a0, 24 [pid 599] <... chdir resumed>) = 0 [pid 600] <... set_robust_list resumed>) = 0 [pid 604] <... creat resumed>) = 3 [pid 604] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 598] <... futex resumed>) = 0 [pid 598] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 598] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] <... futex resumed>) = 1 [pid 604] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 599] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 604] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 598] <... futex resumed>) = 0 [pid 599] setpgid(0, 0 [pid 598] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 599] <... setpgid resumed>) = 0 [pid 598] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] <... futex resumed>) = 1 [pid 604] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 599] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 604] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 598] <... futex resumed>) = 0 [pid 598] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 598] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] <... futex resumed>) = 1 [pid 604] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE) = 5 [pid 604] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 602 attached [pid 601] set_robust_list(0x555556cc76a0, 24 [pid 600] chdir("./13" [pid 599] <... openat resumed>) = 3 [pid 591] +++ exited with 0 +++ [pid 587] +++ exited with 0 +++ [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=587, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 296] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, 0x555556cc8730 /* 5 entries */, 32768) = 128 [pid 296] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 296] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./11/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./11/bus") = 0 [pid 296] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./11/binderfs" [pid 598] <... futex resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 604] <... futex resumed>) = 1 [pid 598] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./11/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 604] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 4, 0 [pid 598] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 604] <... mmap resumed>) = 0x20000000 [pid 598] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] newfstatat(AT_FDCWD, "./11/ext4", [pid 604] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 604] <... futex resumed>) = 1 [pid 598] <... futex resumed>) = 0 [pid 296] umount2("./11/ext4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 604] --- SIGBUS {si_signo=SIGBUS, si_code=BUS_ADRERR, si_addr=0x20000144} --- [pid 598] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 598] <... futex resumed>) = ? [pid 296] openat(AT_FDCWD, "./11/ext4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 296] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(4, 0x555556cd0770 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, 0x555556cd0770 /* 0 entries */, 32768) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./11/ext4") = 0 [pid 296] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./11") = 0 [pid 296] mkdir("./12", 0777 [pid 600] <... chdir resumed>) = 0 [pid 599] write(3, "1000", 4 [pid 296] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 600] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 599] <... write resumed>) = 4 [pid 296] <... openat resumed>) = 3 [pid 296] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 603 attached ) = -1 ENXIO (No such device or address) [pid 603] +++ killed by SIGBUS +++ [pid 296] close(3 [pid 604] +++ killed by SIGBUS +++ [pid 601] <... set_robust_list resumed>) = 0 [pid 600] <... prctl resumed>) = 0 [pid 599] close(3 [pid 598] +++ killed by SIGBUS +++ [pid 296] <... close resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=598, si_uid=0, si_status=SIGBUS, si_utime=0, si_stime=0} --- [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 599] <... close resumed>) = 0 [pid 600] setpgid(0, 0 [pid 296] <... clone resumed>, child_tidptr=0x555556cc7690) = 605 [pid 601] chdir("./15" [pid 599] symlink("/dev/binderfs", "./binderfs" [pid 298] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(3, 0x555556cc8730 /* 4 entries */, 32768) = 104 [pid 298] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 298] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./12/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./12/bus") = 0 [pid 600] <... setpgid resumed>) = 0 [pid 599] <... symlink resumed>) = 0 [pid 298] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./12/binderfs", [pid 599] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./12/binderfs" [pid 600] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 599] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 298] getdents64(3, 0x555556cc8730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./12" [pid 600] <... openat resumed>) = 3 [pid 601] <... chdir resumed>) = 0 [pid 599] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 298] <... rmdir resumed>) = 0 [pid 602] set_robust_list(0x555556cc76a0, 24 [pid 298] mkdir("./13", 0777 [pid 602] <... set_robust_list resumed>) = 0 [pid 601] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 600] write(3, "1000", 4 [pid 599] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 601] <... prctl resumed>) = 0 [pid 600] <... write resumed>) = 4 [pid 599] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 298] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 601] setpgid(0, 0 [pid 600] close(3 [pid 599] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... openat resumed>) = 3 [pid 601] <... setpgid resumed>) = 0 [pid 600] <... close resumed>) = 0 [pid 599] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 600] symlink("/dev/binderfs", "./binderfs" [pid 599] <... mmap resumed>) = 0x7f6220445000 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 601] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 599] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 298] close(3 [pid 600] <... symlink resumed>) = 0 [pid 599] <... mprotect resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 601] <... openat resumed>) = 3 [pid 600] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 601] write(3, "1000", 4 [pid 600] <... futex resumed>) = 0 [pid 599] rt_sigprocmask(SIG_BLOCK, ~[], [pid 601] <... write resumed>) = 4 [pid 600] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 599] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556cc7690) = 606 ./strace-static-x86_64: Process 606 attached [pid 602] chdir("./13" [pid 601] close(3 [pid 600] <... rt_sigaction resumed>NULL, 8) = 0 [pid 599] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 600] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 606] set_robust_list(0x555556cc76a0, 24 [pid 602] <... chdir resumed>) = 0 [pid 601] <... close resumed>) = 0 [pid 600] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 599] <... clone3 resumed> => {parent_tid=[607]}, 88) = 607 [pid 600] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 606] <... set_robust_list resumed>) = 0 [pid 602] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 601] symlink("/dev/binderfs", "./binderfs" [pid 600] <... mmap resumed>) = 0x7f6220445000 [pid 599] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 605 attached [pid 605] set_robust_list(0x555556cc76a0, 24) = 0 [pid 605] chdir("./12") = 0 [pid 599] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 600] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 605] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 605] setpgid(0, 0 [pid 601] <... symlink resumed>) = 0 [pid 600] <... mprotect resumed>) = 0 [pid 599] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] <... setpgid resumed>) = 0 [pid 605] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 599] <... futex resumed>) = 0 [pid 602] <... prctl resumed>) = 0 [pid 601] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] rt_sigprocmask(SIG_BLOCK, ~[], [pid 599] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] <... openat resumed>) = 3 [pid 601] <... futex resumed>) = 0 [pid 600] <... rt_sigprocmask resumed>[], 8) = 0 [pid 599] <... futex resumed>) = 0 [pid 606] chdir("./13" [pid 605] write(3, "1000", 4 [pid 602] setpgid(0, 0 [pid 601] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 600] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 599] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 605] <... write resumed>) = 4 [pid 605] close(3) = 0 [pid 605] symlink("/dev/binderfs", "./binderfs") = 0 [pid 605] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 605] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 599] <... mmap resumed>) = 0x7f6220424000 [pid 601] <... rt_sigaction resumed>NULL, 8) = 0 [pid 605] <... rt_sigaction resumed>NULL, 8) = 0 [pid 601] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 600] <... clone3 resumed> => {parent_tid=[608]}, 88) = 608 [pid 599] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 605] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 601] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 600] rt_sigprocmask(SIG_SETMASK, [], [pid 599] <... mprotect resumed>) = 0 [pid 602] <... setpgid resumed>) = 0 ./strace-static-x86_64: Process 607 attached [pid 606] <... chdir resumed>) = 0 [pid 605] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 601] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 600] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 599] rt_sigprocmask(SIG_BLOCK, ~[], [pid 607] set_robust_list(0x7f62204659a0, 24 [pid 605] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 601] <... mmap resumed>) = 0x7f6220445000 [pid 600] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] <... rt_sigprocmask resumed>[], 8) = 0 [pid 607] <... set_robust_list resumed>) = 0 [pid 605] <... mmap resumed>) = 0x7f6220445000 [pid 601] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 600] <... futex resumed>) = 0 [pid 599] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 607] rt_sigprocmask(SIG_SETMASK, [], [pid 605] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 601] <... mprotect resumed>) = 0 [pid 607] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 605] <... mprotect resumed>) = 0 [pid 600] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 607] memfd_create("syzkaller", 0 [pid 605] rt_sigprocmask(SIG_BLOCK, ~[], [pid 601] rt_sigprocmask(SIG_BLOCK, ~[], [pid 600] <... futex resumed>) = 0 [pid 599] <... clone3 resumed> => {parent_tid=[609]}, 88) = 609 [pid 607] <... memfd_create resumed>) = 3 [pid 605] <... rt_sigprocmask resumed>[], 8) = 0 [pid 602] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 601] <... rt_sigprocmask resumed>[], 8) = 0 [pid 600] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 599] rt_sigprocmask(SIG_SETMASK, [], [pid 607] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 606] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 605] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 602] <... openat resumed>) = 3 [pid 601] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 600] <... mmap resumed>) = 0x7f6220424000 [pid 599] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 607] <... mmap resumed>) = 0x7f6218024000 [pid 606] <... prctl resumed>) = 0 ./strace-static-x86_64: Process 611 attached [pid 607] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 606] setpgid(0, 0 [pid 605] <... clone3 resumed> => {parent_tid=[610]}, 88) = 610 [pid 602] write(3, "1000", 4 [pid 600] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 599] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 608 attached [pid 611] set_robust_list(0x7f62204659a0, 24 [pid 607] <... write resumed>) = 262144 [pid 606] <... setpgid resumed>) = 0 [pid 605] rt_sigprocmask(SIG_SETMASK, [], [pid 602] <... write resumed>) = 4 [pid 601] <... clone3 resumed> => {parent_tid=[611]}, 88) = 611 [pid 600] <... mprotect resumed>) = 0 [pid 599] <... futex resumed>) = 0 [pid 608] set_robust_list(0x7f62204659a0, 24 [pid 607] munmap(0x7f6218024000, 262144 [pid 605] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 602] close(3 [pid 601] rt_sigprocmask(SIG_SETMASK, [], [pid 600] rt_sigprocmask(SIG_BLOCK, ~[], [pid 608] <... set_robust_list resumed>) = 0 [pid 607] <... munmap resumed>) = 0 [pid 605] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... close resumed>) = 0 [pid 601] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 600] <... rt_sigprocmask resumed>[], 8) = 0 [pid 599] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 609 attached [pid 608] rt_sigprocmask(SIG_SETMASK, [], [pid 607] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 605] <... futex resumed>) = 0 [pid 602] symlink("/dev/binderfs", "./binderfs" [pid 601] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 609] set_robust_list(0x7f62204449a0, 24 [pid 608] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 607] <... openat resumed>) = 4 [pid 605] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] <... futex resumed>) = 0 ./strace-static-x86_64: Process 612 attached [pid 611] <... set_robust_list resumed>) = 0 [pid 609] <... set_robust_list resumed>) = 0 [pid 608] memfd_create("syzkaller", 0 [pid 607] ioctl(4, LOOP_SET_FD, 3 [pid 606] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 605] <... futex resumed>) = 0 [pid 602] <... symlink resumed>) = 0 [pid 601] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 610 attached [pid 612] set_robust_list(0x7f62204449a0, 24 [pid 611] rt_sigprocmask(SIG_SETMASK, [], [pid 609] rt_sigprocmask(SIG_SETMASK, [], [pid 608] <... memfd_create resumed>) = 3 [pid 607] <... ioctl resumed>) = 0 [pid 606] <... openat resumed>) = 3 [pid 605] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 602] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] <... futex resumed>) = 0 [pid 600] <... clone3 resumed> => {parent_tid=[612]}, 88) = 612 [pid 612] <... set_robust_list resumed>) = 0 [pid 611] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 610] set_robust_list(0x7f62204659a0, 24 [pid 609] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 606] write(3, "1000", 4 [pid 602] <... futex resumed>) = 0 [pid 601] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 600] rt_sigprocmask(SIG_SETMASK, [], [pid 612] rt_sigprocmask(SIG_SETMASK, [], [pid 611] memfd_create("syzkaller", 0 [pid 610] <... set_robust_list resumed>) = 0 [pid 606] <... write resumed>) = 4 [pid 605] <... mmap resumed>) = 0x7f6220424000 [pid 602] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 601] <... mmap resumed>) = 0x7f6220424000 [pid 600] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 612] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 611] <... memfd_create resumed>) = 3 [pid 610] rt_sigprocmask(SIG_SETMASK, [], [pid 609] creat("./bus", 000 [pid 608] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 606] close(3 [pid 602] <... rt_sigaction resumed>NULL, 8) = 0 [pid 605] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 601] mprotect(0x7f6220425000, 131072, PROT_READ|PROT_WRITE [pid 600] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 612] creat("./bus", 000 [pid 611] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 610] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 609] <... creat resumed>) = 5 [pid 608] <... mmap resumed>) = 0x7f6218024000 [pid 606] <... close resumed>) = 0 [pid 605] <... mprotect resumed>) = 0 [pid 602] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 601] <... mprotect resumed>) = 0 [pid 600] <... futex resumed>) = 0 [pid 612] <... creat resumed>) = 4 [pid 611] <... mmap resumed>) = 0x7f6218024000 [pid 610] memfd_create("syzkaller", 0 [pid 606] symlink("/dev/binderfs", "./binderfs" [pid 605] rt_sigprocmask(SIG_BLOCK, ~[], [pid 602] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 601] rt_sigprocmask(SIG_BLOCK, ~[], [pid 600] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 612] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 610] <... memfd_create resumed>) = 3 [pid 609] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 606] <... symlink resumed>) = 0 [pid 605] <... rt_sigprocmask resumed>[], 8) = 0 [pid 602] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 601] <... rt_sigprocmask resumed>[], 8) = 0 [pid 600] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 612] <... futex resumed>) = 0 [pid 611] <... write resumed>) = 262144 [pid 610] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 606] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 602] <... mmap resumed>) = 0x7f6220445000 [pid 609] <... futex resumed>) = 1 [pid 601] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220444990, parent_tid=0x7f6220444990, exit_signal=0, stack=0x7f6220424000, stack_size=0x20300, tls=0x7f62204446c0} [pid 600] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] <... futex resumed>) = 0 [pid 612] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 611] munmap(0x7f6218024000, 262144 [pid 610] <... mmap resumed>) = 0x7f6218024000 [pid 609] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 608] <... write resumed>) = 262144 [pid 606] <... futex resumed>) = 0 [pid 602] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 600] <... futex resumed>) = 0 [pid 599] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 612] <... mount resumed>) = 0 [pid 611] <... munmap resumed>) = 0 [pid 610] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 609] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 608] munmap(0x7f6218024000, 262144 [pid 606] rt_sigaction(SIGRT_1, {sa_handler=0x7f62204cf260, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f62204c0410}, [pid 605] <... clone3 resumed> => {parent_tid=[613]}, 88) = 613 [pid 602] <... mprotect resumed>) = 0 [pid 601] <... clone3 resumed> => {parent_tid=[614]}, 88) = 614 [pid 600] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 599] <... futex resumed>) = 0 [pid 612] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 610] <... write resumed>) = 262144 [pid 609] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 608] <... munmap resumed>) = 0 [pid 606] <... rt_sigaction resumed>NULL, 8) = 0 [pid 605] rt_sigprocmask(SIG_SETMASK, [], [pid 602] rt_sigprocmask(SIG_BLOCK, ~[], [pid 601] rt_sigprocmask(SIG_SETMASK, [], [pid 600] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 599] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 612] <... futex resumed>) = 0 [pid 611] <... openat resumed>) = 4 [pid 610] munmap(0x7f6218024000, 262144 [pid 606] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 605] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 602] <... rt_sigprocmask resumed>[], 8) = 0 [pid 601] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 600] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 612] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 611] ioctl(4, LOOP_SET_FD, 3 [pid 610] <... munmap resumed>) = 0 [pid 609] <... mount resumed>) = 0 [pid 608] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 606] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 605] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 601] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] <... futex resumed>) = 0 ./strace-static-x86_64: Process 614 attached ./strace-static-x86_64: Process 613 attached [pid 612] <... open resumed>) = 5 [pid 609] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] <... openat resumed>) = 6 [pid 607] close(3 [pid 605] <... futex resumed>) = 0 [pid 614] set_robust_list(0x7f62204449a0, 24 [pid 609] <... futex resumed>) = 1 [pid 608] ioctl(6, LOOP_SET_FD, 3 [pid 607] <... close resumed>) = 0 [pid 605] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 599] <... futex resumed>) = 0 ./strace-static-x86_64: Process 615 attached [pid 614] <... set_robust_list resumed>) = 0 [pid 613] set_robust_list(0x7f62204449a0, 24 [pid 612] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] <... ioctl resumed>) = 0 [pid 610] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 609] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 606] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 601] <... futex resumed>) = 0 [pid 600] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 615] set_robust_list(0x7f62204659a0, 24 [pid 613] <... set_robust_list resumed>) = 0 [pid 612] <... futex resumed>) = 0 [pid 611] close(3 [pid 610] <... openat resumed>) = 4 [pid 606] <... mmap resumed>) = 0x7f6220445000 [pid 602] <... clone3 resumed> => {parent_tid=[615]}, 88) = 615 [pid 601] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 600] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 615] <... set_robust_list resumed>) = 0 [pid 613] rt_sigprocmask(SIG_SETMASK, [], [pid 612] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 611] <... close resumed>) = 0 [pid 610] ioctl(4, LOOP_SET_FD, 3 [pid 606] mprotect(0x7f6220446000, 131072, PROT_READ|PROT_WRITE [pid 602] rt_sigprocmask(SIG_SETMASK, [], [pid 600] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 615] rt_sigprocmask(SIG_SETMASK, [], [pid 614] rt_sigprocmask(SIG_SETMASK, [], [pid 613] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 612] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 609] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 608] <... ioctl resumed>) = 0 [pid 607] mkdir("./file0", 0777 [pid 599] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 614] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 609] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 608] close(3 [pid 607] <... mkdir resumed>) = 0 [pid 599] <... futex resumed>) = 0 [pid 614] creat("./bus", 000 [pid 609] <... open resumed>) = 3 [pid 608] <... close resumed>) = 0 [pid 607] mount("/dev/loop1", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 599] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 614] <... creat resumed>) = 3 [pid 609] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] mkdir("./file0", 0777 [pid 599] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 614] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] <... futex resumed>) = 0 [pid 608] <... mkdir resumed>) = 0 [pid 599] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 614] <... futex resumed>) = 1 [pid 609] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 608] mount("/dev/loop5", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 599] <... futex resumed>) = 0 [pid 614] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 609] <... socket resumed>) = 6 [pid 599] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 609] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 609] <... futex resumed>) = 0 [pid 599] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 3, 0 [pid 599] <... futex resumed>) = 0 [pid 609] <... mmap resumed>) = 0x20000000 [pid 599] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 609] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 609] <... futex resumed>) = 0 [pid 599] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 25.811066][ T607] loop1: detected capacity change from 0 to 512 [ 25.843024][ T611] loop4: detected capacity change from 0 to 512 [ 25.848745][ T608] loop5: detected capacity change from 0 to 512 [ 25.852235][ T610] loop0: detected capacity change from 0 to 512 [pid 611] mkdir("./file0", 0777 [pid 612] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 611] <... mkdir resumed>) = 0 [pid 606] <... mprotect resumed>) = 0 [pid 602] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 615] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 613] creat("./bus", 000 [pid 610] <... ioctl resumed>) = 0 [pid 609] memfd_create("syzkaller", 0 [pid 601] <... futex resumed>) = 0 [pid 600] <... futex resumed>) = 0 [pid 615] memfd_create("syzkaller", 0 [pid 613] <... creat resumed>) = 5 [pid 612] <... socket resumed>) = 3 [pid 611] mount("/dev/loop4", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 610] close(3 [pid 609] <... memfd_create resumed>) = 7 [pid 607] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 606] rt_sigprocmask(SIG_BLOCK, ~[], [pid 602] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 615] <... memfd_create resumed>) = 3 [pid 614] <... futex resumed>) = 0 [pid 613] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 612] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 610] <... close resumed>) = 0 [pid 609] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 606] <... rt_sigprocmask resumed>[], 8) = 0 [pid 602] <... futex resumed>) = 0 [pid 601] <... futex resumed>) = 1 [pid 600] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 615] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 614] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 613] <... futex resumed>) = 1 [pid 612] <... futex resumed>) = 0 [pid 610] mkdir("./file0", 0777 [pid 609] <... mmap resumed>) = 0x7f620fc64000 [pid 606] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6220465990, parent_tid=0x7f6220465990, exit_signal=0, stack=0x7f6220445000, stack_size=0x20300, tls=0x7f62204656c0} [pid 605] <... futex resumed>) = 0 [pid 602] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 600] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 615] <... mmap resumed>) = 0x7f6218045000 [pid 614] <... mount resumed>) = 0 [pid 613] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 612] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 609] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 607] ioctl(4, LOOP_CLR_FD [pid 605] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... futex resumed>) = 0 [pid 600] <... futex resumed>) = 0 [pid 614] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 607] <... ioctl resumed>) = 0 [pid 605] <... futex resumed>) = 0 [pid 614] <... futex resumed>) = 1 [pid 607] close(4 [pid 605] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 616 attached [pid 615] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 614] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 613] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 612] <... mmap resumed>) = 0x20000000 [pid 610] <... mkdir resumed>) = 0 [pid 609] <... write resumed>) = 65536 [pid 606] <... clone3 resumed> => {parent_tid=[616]}, 88) = 616 [pid 602] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 601] <... futex resumed>) = 0 [pid 600] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 616] set_robust_list(0x7f62204659a0, 24 [pid 615] <... write resumed>) = 262144 [pid 613] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 612] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 610] mount("/dev/loop0", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 609] munmap(0x7f620fc64000, 65536 [pid 606] rt_sigprocmask(SIG_SETMASK, [], [pid 602] <... mmap resumed>) = 0x7f6218024000 [pid 601] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 600] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 614] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 616] <... set_robust_list resumed>) = 0 [pid 615] munmap(0x7f6218045000, 262144 [pid 614] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 613] <... mount resumed>) = 0 [pid 612] <... futex resumed>) = 0 [pid 609] <... munmap resumed>) = 0 [pid 607] <... close resumed>) = 0 [pid 606] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 602] mprotect(0x7f6218025000, 131072, PROT_READ|PROT_WRITE [pid 601] <... futex resumed>) = 0 [pid 600] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] rt_sigprocmask(SIG_SETMASK, [], [pid 615] <... munmap resumed>) = 0 [pid 614] <... open resumed>) = 5 [pid 613] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 612] memfd_create("syzkaller", 0 [pid 609] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 607] futex(0x7f62205316cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] futex(0x7f62205316c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... mprotect resumed>) = 0 [pid 601] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 600] <... futex resumed>) = 0 [pid 616] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 615] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 614] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... futex resumed>) = 1 [pid 612] <... memfd_create resumed>) = 7 [pid 609] <... openat resumed>) = 4 [pid 607] <... futex resumed>) = 0 [pid 606] <... futex resumed>) = 0 [pid 605] <... futex resumed>) = 0 [pid 602] rt_sigprocmask(SIG_BLOCK, ~[], [pid 601] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 616] memfd_create("syzkaller", 0 [pid 615] <... openat resumed>) = 4 [pid 613] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 612] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 609] ioctl(4, LOOP_SET_FD, 7 [pid 606] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... rt_sigprocmask resumed>[], 8) = 0 [pid 601] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] <... memfd_create resumed>) = 3 [pid 615] ioctl(4, LOOP_SET_FD, 3 [pid 614] <... futex resumed>) = 0 [pid 613] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 612] <... mmap resumed>) = 0x7f620fc64000 [pid 609] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 606] <... futex resumed>) = 0 [pid 605] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6218044990, parent_tid=0x7f6218044990, exit_signal=0, stack=0x7f6218024000, stack_size=0x20300, tls=0x7f62180446c0} [pid 601] <... futex resumed>) = 0 [pid 616] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 615] <... ioctl resumed>) = 0 [pid 614] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 613] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 612] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536 [pid 609] ioctl(4, LOOP_CLR_FD [pid 607] futex(0x7f62205316c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 606] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 605] <... futex resumed>) = 0 [pid 601] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 616] <... mmap resumed>) = 0x7f6218045000 [pid 615] close(3 [pid 614] <... socket resumed>) = 6 [pid 613] <... open resumed>) = 3 [pid 609] <... ioctl resumed>) = 0 [pid 606] <... mmap resumed>) = 0x7f6218024000 [pid 605] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 602] <... clone3 resumed> => {parent_tid=[619]}, 88) = 619 [pid 616] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 615] <... close resumed>) = 0 [pid 614] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] mprotect(0x7f6218025000, 131072, PROT_READ|PROT_WRITE [pid 605] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 602] rt_sigprocmask(SIG_SETMASK, [], [pid 616] <... write resumed>) = 262144 [pid 615] mkdir("./file0", 0777 [pid 614] <... futex resumed>) = 1 [pid 613] <... futex resumed>) = 0 [ 25.862036][ T607] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 25.878744][ T615] loop3: detected capacity change from 0 to 512 [ 25.878751][ T608] EXT4-fs warning (device loop5): read_mmp_block:115: Error -74 while reading MMP block 12 [pid 606] <... mprotect resumed>) = 0 [pid 605] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 601] <... futex resumed>) = 0 [pid 616] munmap(0x7f6218045000, 262144 [pid 615] <... mkdir resumed>) = 0 [pid 614] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 613] socket(AF_INET, SOCK_DGRAM, IPPROTO_UDPLITE [pid 606] rt_sigprocmask(SIG_BLOCK, ~[], [pid 605] <... futex resumed>) = 0 [pid 602] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] <... munmap resumed>) = 0 [pid 615] mount("/dev/loop3", "./file0", "ext4", MS_SYNCHRONOUS|MS_NODIRATIME|MS_RELATIME, "nodiscard,barrier,nouid32,grpquota,,errors=continue" [pid 614] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 613] <... socket resumed>) = 6 [pid 609] ioctl(4, LOOP_SET_FD, 7 [pid 606] <... rt_sigprocmask resumed>[], 8) = 0 [pid 605] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 602] <... futex resumed>) = 0 [pid 601] <... futex resumed>) = 0 [pid 616] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 614] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 5, 0 [pid 613] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 606] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6218044990, parent_tid=0x7f6218044990, exit_signal=0, stack=0x7f6218024000, stack_size=0x20300, tls=0x7f62180446c0} [pid 605] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 602] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 601] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 622 attached ./strace-static-x86_64: Process 619 attached [pid 616] <... openat resumed>) = 4 [pid 614] <... mmap resumed>) = 0x20000000 [pid 613] <... futex resumed>) = 0 [pid 612] <... write resumed>) = 65536 [pid 611] <... mount resumed>) = 0 [pid 609] close(4 [pid 608] <... mount resumed>) = -1 EBADMSG (Bad message) [pid 605] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 622] set_robust_list(0x7f62180449a0, 24 [pid 614] futex(0x7f62205316dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 612] munmap(0x7f620fc64000, 65536 [pid 605] <... futex resumed>) = 0 [pid 622] <... set_robust_list resumed>) = 0 [pid 614] <... futex resumed>) = 1 [pid 612] <... munmap resumed>) = 0 [pid 605] futex(0x7f62205316dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 601] <... futex resumed>) = 0 [pid 622] rt_sigprocmask(SIG_SETMASK, [], [pid 614] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 612] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 601] futex(0x7f62205316d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 622] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 614] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 612] <... openat resumed>) = 8 [pid 601] <... futex resumed>) = 0 [pid 622] futex(0x7f62205316d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 614] memfd_create("syzkaller", 0 [pid 612] ioctl(8, LOOP_SET_FD, 7 [pid 614] <... memfd_create resumed>) = 7 [pid 612] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 614] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 612] ioctl(8, LOOP_CLR_FD [pid 614] <... mmap resumed>) = 0x7f620fc64000 [pid 612] <... ioctl resumed>) = 0 [pid 614] write(7, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 65536) = 65536 [pid 614] munmap(0x7f620fc64000, 65536) = 0 [pid 614] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 8 [pid 614] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 614] ioctl(8, LOOP_CLR_FD) = 0 [pid 612] ioctl(8, LOOP_SET_FD, 7) = -1 EBUSY (Device or resource busy) [pid 612] close(8 [pid 619] set_robust_list(0x7f62180449a0, 24 [pid 616] ioctl(4, LOOP_SET_FD, 3 [pid 613] mmap(0x20000000, 6291456, PROT_WRITE|PROT_GROWSDOWN|PROT_GROWSUP, MAP_SHARED|MAP_FIXED, 3, 0 [pid 612] <... close resumed>) = 0 [pid 611] openat(AT_FDCWD, 0x20000000, O_RDONLY|O_DIRECTORY [pid 610] <... mount resumed>) = 0 [pid 609] <... close resumed>) = 0 [pid 608] ioctl(6, LOOP_CLR_FD [pid 606] <... clone3 resumed> => {parent_tid=[622]}, 88) = 622 [pid 619] <... set_robust_list resumed>) = 0 [pid 614] ioctl(8, LOOP_SET_FD, 7 [pid 612] close(7 [pid 614] <... ioctl resumed>) = -1 EBUSY (Device or resource busy) [pid 612] <... close resumed>) = 0 [ 25.900603][ T611] EXT4-fs (loop4): mounted filesystem without journal. Opts: nodiscard,barrier,nouid32,grpquota,,errors=continue. Quota mode: writeback. [ 25.915685][ T611] ext4 filesystem being mounted at /root/syzkaller.Zpv55J/15/file0 supports timestamps until 2038 (0x7fffffff) [ 25.916375][ T610] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodiscard,barrier,nouid32,grpquota,,errors=continue. Quota mode: writeback. [ 25.942148][ T610] ext4 filesystem being mounted at /root/syzkaller.sY6u5M/12/file0 supports timestamps until 2038 (0x7fffffff) [ 25.954997][ T616] loop2: detected capacity change from 0 to 512 [pid 614] close(8 [pid