./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3547834509 <...> RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6065] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6064] <... openat resumed>) = 6 [pid 6064] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6065] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6064] <... futex resumed>) = 0 [pid 6064] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6063] <... futex resumed>) = 0 [pid 6063] exit_group(0) = ? [pid 6064] <... futex resumed>) = ? [pid 6064] +++ exited with 0 +++ [pid 6065] <... futex resumed>) = ? [pid 6065] +++ exited with 0 +++ [pid 6063] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6063, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./339", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./339", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./339/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./339/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./339/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./339/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./339/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./339/bus") = 0 umount2("./339/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./339/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./339/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./339") = 0 mkdir("./340", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6066 attached , child_tidptr=0x5555564f6750) = 6066 [pid 6066] set_robust_list(0x5555564f6760, 24) = 0 [pid 6066] chdir("./340") = 0 [pid 6066] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6066] setpgid(0, 0) = 0 [pid 6066] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6066] write(3, "1000", 4) = 4 [pid 6066] close(3) = 0 [pid 6066] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6066] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6066] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6066] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6066] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6066] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6066] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6066] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6067 attached [pid 6067] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6066] <... clone3 resumed> => {parent_tid=[6067]}, 88) = 6067 [pid 6067] <... rseq resumed>) = 0 [pid 6067] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6067] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6066] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6067] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6066] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6067] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6067] memfd_create("syzkaller", 0 [pid 6066] <... futex resumed>) = 0 [pid 6067] <... memfd_create resumed>) = 3 [pid 6066] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6067] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6067] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6067] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6067] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6067] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6067] close(3) = 0 [pid 6067] mkdir("./bus", 0777) = 0 [pid 6067] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6067] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6067] chdir("./bus") = 0 [pid 6067] ioctl(4, LOOP_CLR_FD) = 0 [pid 6067] close(4) = 0 [pid 6067] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6066] <... futex resumed>) = 0 [pid 6067] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6066] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6067] <... futex resumed>) = 0 [pid 6066] <... futex resumed>) = 1 [pid 6067] memfd_create("syzkaller", 0 [pid 6066] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6067] <... memfd_create resumed>) = 4 [pid 6067] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6067] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6067] munmap(0x7f6d360cf000, 32768) = 0 [pid 6067] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6067] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6067] ioctl(5, LOOP_CLR_FD) = 0 [pid 6067] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6067] close(5) = 0 [pid 6067] close(4) = 0 [pid 6067] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6067] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6066] <... futex resumed>) = 0 [pid 6066] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6067] <... futex resumed>) = 0 [pid 6067] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6066] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6067] <... openat resumed>) = 4 [pid 6067] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6066] <... futex resumed>) = 0 [pid 6067] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6066] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6067] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6067] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6066] <... futex resumed>) = 0 [pid 6066] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6067] <... write resumed>) = 12288 [pid 6067] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6066] <... futex resumed>) = 0 [pid 6067] <... futex resumed>) = 1 [pid 6066] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6067] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6066] <... futex resumed>) = 0 [pid 6067] <... mmap resumed>) = 0x20000000 [pid 6067] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6066] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6067] <... futex resumed>) = 0 [pid 6066] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6067] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6066] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6067] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6066] <... futex resumed>) = 0 [ 124.387068][ T6067] loop0: detected capacity change from 0 to 64 [pid 6067] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6066] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6067] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6067] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6066] <... futex resumed>) = 0 [pid 6067] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6066] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6067] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6066] <... futex resumed>) = 0 [pid 6067] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6066] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6067] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6066] <... futex resumed>) = 0 [pid 6066] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6067] <... openat resumed>) = 6 [pid 6066] <... mmap resumed>) = 0x7f6d360b6000 [pid 6067] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6067] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6066] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6066] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6066] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6068 attached => {parent_tid=[6068]}, 88) = 6068 [pid 6068] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6066] rt_sigprocmask(SIG_SETMASK, [], [pid 6068] <... rseq resumed>) = 0 [pid 6066] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6068] set_robust_list(0x7f6d360d69a0, 24 [pid 6066] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6068] <... set_robust_list resumed>) = 0 [pid 6066] <... futex resumed>) = 0 [pid 6068] rt_sigprocmask(SIG_SETMASK, [], [pid 6066] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6068] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6068] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6068] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6066] <... futex resumed>) = 0 [pid 6068] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6066] exit_group(0 [pid 6068] <... futex resumed>) = ? [pid 6068] +++ exited with 0 +++ [pid 6067] <... futex resumed>) = ? [pid 6066] <... exit_group resumed>) = ? [pid 6067] +++ exited with 0 +++ [pid 6066] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6066, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./340", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./340", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./340/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./340/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./340/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./340/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./340/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./340/bus") = 0 umount2("./340/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./340/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./340/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./340") = 0 mkdir("./341", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6069 attached , child_tidptr=0x5555564f6750) = 6069 [pid 6069] set_robust_list(0x5555564f6760, 24) = 0 [pid 6069] chdir("./341") = 0 [pid 6069] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6069] setpgid(0, 0) = 0 [pid 6069] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6069] write(3, "1000", 4) = 4 [pid 6069] close(3) = 0 [pid 6069] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6069] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6069] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6069] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6069] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6069] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6069] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6069] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6070 attached => {parent_tid=[6070]}, 88) = 6070 [pid 6069] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6069] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6069] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6070] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6070] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6070] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6070] memfd_create("syzkaller", 0) = 3 [pid 6070] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6070] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6070] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6070] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6070] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6070] close(3) = 0 [pid 6070] mkdir("./bus", 0777) = 0 [pid 6070] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6070] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6070] chdir("./bus") = 0 [pid 6070] ioctl(4, LOOP_CLR_FD) = 0 [pid 6070] close(4) = 0 [pid 6070] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6070] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6069] <... futex resumed>) = 0 [pid 6070] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6069] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6070] memfd_create("syzkaller", 0) = 4 [pid 6069] <... futex resumed>) = 0 [pid 6069] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6070] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6070] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6070] munmap(0x7f6d360cf000, 32768) = 0 [pid 6070] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6070] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6070] ioctl(5, LOOP_CLR_FD) = 0 [pid 6070] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6070] close(5) = 0 [pid 6070] close(4) = 0 [pid 6070] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6069] <... futex resumed>) = 0 [pid 6069] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6070] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6069] <... futex resumed>) = 0 [pid 6069] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6070] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6069] <... futex resumed>) = 0 [pid 6070] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6069] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6069] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6070] <... write resumed>) = 12288 [pid 6070] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6069] <... futex resumed>) = 0 [pid 6070] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 6069] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6070] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6069] <... futex resumed>) = 0 [pid 6069] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6070] <... mmap resumed>) = 0x20000000 [pid 6070] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6069] <... futex resumed>) = 0 [pid 6069] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6069] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6070] <... futex resumed>) = 1 [pid 6070] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [ 124.527902][ T6070] loop0: detected capacity change from 0 to 64 [pid 6070] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6070] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6069] <... futex resumed>) = 0 [pid 6069] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6069] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6069] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6069] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6069] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6069] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6071 attached [pid 6071] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6069] <... clone3 resumed> => {parent_tid=[6071]}, 88) = 6071 [pid 6071] <... rseq resumed>) = 0 [pid 6071] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6071] rt_sigprocmask(SIG_SETMASK, [], [pid 6069] rt_sigprocmask(SIG_SETMASK, [], [pid 6071] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6069] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6071] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6069] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6071] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6069] <... futex resumed>) = 0 [pid 6071] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6069] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6070] <... futex resumed>) = 1 [pid 6071] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6070] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6071] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6070] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6069] <... futex resumed>) = 0 [pid 6071] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6070] <... openat resumed>) = 6 [pid 6070] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6070] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6069] exit_group(0 [pid 6071] <... futex resumed>) = ? [pid 6070] <... futex resumed>) = ? [pid 6069] <... exit_group resumed>) = ? [pid 6070] +++ exited with 0 +++ [pid 6071] +++ exited with 0 +++ [pid 6069] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6069, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./341", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./341", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./341/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./341/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./341/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./341/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./341/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./341/bus") = 0 umount2("./341/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./341/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./341/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./341") = 0 mkdir("./342", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6072 ./strace-static-x86_64: Process 6072 attached [pid 6072] set_robust_list(0x5555564f6760, 24) = 0 [pid 6072] chdir("./342") = 0 [pid 6072] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6072] setpgid(0, 0) = 0 [pid 6072] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6072] write(3, "1000", 4) = 4 [pid 6072] close(3) = 0 [pid 6072] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6072] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6072] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6072] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6072] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6072] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6072] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6072] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6073 attached [pid 6073] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6073] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6073] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6072] <... clone3 resumed> => {parent_tid=[6073]}, 88) = 6073 [pid 6073] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6072] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6072] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6073] <... futex resumed>) = 0 [pid 6072] <... futex resumed>) = 1 [pid 6073] memfd_create("syzkaller", 0 [pid 6072] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6073] <... memfd_create resumed>) = 3 [pid 6073] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6073] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6073] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6073] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6073] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6073] close(3) = 0 [pid 6073] mkdir("./bus", 0777) = 0 [pid 6073] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6073] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6073] chdir("./bus") = 0 [pid 6073] ioctl(4, LOOP_CLR_FD) = 0 [pid 6073] close(4) = 0 [pid 6073] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6072] <... futex resumed>) = 0 [pid 6072] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6072] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6073] <... futex resumed>) = 1 [pid 6073] memfd_create("syzkaller", 0) = 4 [pid 6073] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6073] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6073] munmap(0x7f6d360cf000, 32768) = 0 [pid 6073] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6073] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6073] ioctl(5, LOOP_CLR_FD) = 0 [pid 6073] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6073] close(5) = 0 [pid 6073] close(4) = 0 [pid 6073] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6072] <... futex resumed>) = 0 [pid 6072] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6073] <... futex resumed>) = 1 [pid 6072] <... futex resumed>) = 0 [pid 6073] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6072] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6073] <... openat resumed>) = 4 [pid 6073] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6072] <... futex resumed>) = 0 [pid 6073] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6072] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6073] <... futex resumed>) = 0 [pid 6073] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6072] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6073] <... write resumed>) = 12288 [pid 6073] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6072] <... futex resumed>) = 0 [pid 6073] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6072] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6073] <... futex resumed>) = 0 [pid 6072] <... futex resumed>) = 1 [pid 6073] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6072] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6073] <... mmap resumed>) = 0x20000000 [pid 6073] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6072] <... futex resumed>) = 0 [pid 6073] <... futex resumed>) = 1 [pid 6072] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6073] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6072] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6073] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6073] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6072] <... futex resumed>) = 0 [pid 6072] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6073] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6072] <... futex resumed>) = 0 [pid 6072] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6073] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6072] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6073] <... openat resumed>) = 6 [ 124.659445][ T6073] loop0: detected capacity change from 0 to 64 [pid 6072] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6073] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6072] <... mprotect resumed>) = 0 [pid 6073] <... futex resumed>) = 0 [pid 6072] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6073] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6072] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6072] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6074 attached [pid 6074] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6072] <... clone3 resumed> => {parent_tid=[6074]}, 88) = 6074 [pid 6074] <... rseq resumed>) = 0 [pid 6072] rt_sigprocmask(SIG_SETMASK, [], [pid 6074] set_robust_list(0x7f6d360d69a0, 24 [pid 6072] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6074] <... set_robust_list resumed>) = 0 [pid 6072] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6074] rt_sigprocmask(SIG_SETMASK, [], [pid 6072] <... futex resumed>) = 0 [pid 6074] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6072] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6074] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6074] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6072] <... futex resumed>) = 0 [pid 6074] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6072] exit_group(0 [pid 6074] <... futex resumed>) = ? [pid 6073] <... futex resumed>) = ? [pid 6072] <... exit_group resumed>) = ? [pid 6074] +++ exited with 0 +++ [pid 6073] +++ exited with 0 +++ [pid 6072] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6072, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./342", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./342", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./342/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./342/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./342/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./342/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./342/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./342/bus") = 0 umount2("./342/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./342/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./342/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./342") = 0 mkdir("./343", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6075 attached , child_tidptr=0x5555564f6750) = 6075 [pid 6075] set_robust_list(0x5555564f6760, 24) = 0 [pid 6075] chdir("./343") = 0 [pid 6075] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6075] setpgid(0, 0) = 0 [pid 6075] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6075] write(3, "1000", 4) = 4 [pid 6075] close(3) = 0 [pid 6075] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6075] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6075] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6075] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6075] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6075] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6075] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6075] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6076 attached => {parent_tid=[6076]}, 88) = 6076 [pid 6076] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6075] rt_sigprocmask(SIG_SETMASK, [], [pid 6076] <... rseq resumed>) = 0 [pid 6076] set_robust_list(0x7f6d468e79a0, 24 [pid 6075] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6076] <... set_robust_list resumed>) = 0 [pid 6075] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6076] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6075] <... futex resumed>) = 0 [pid 6076] memfd_create("syzkaller", 0 [pid 6075] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6076] <... memfd_create resumed>) = 3 [pid 6076] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6076] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6076] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6076] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6076] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6076] close(3) = 0 [pid 6076] mkdir("./bus", 0777) = 0 [pid 6076] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6076] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6076] chdir("./bus") = 0 [pid 6076] ioctl(4, LOOP_CLR_FD) = 0 [pid 6076] close(4) = 0 [pid 6076] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6075] <... futex resumed>) = 0 [pid 6076] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6075] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6076] <... futex resumed>) = 0 [pid 6075] <... futex resumed>) = 1 [pid 6076] memfd_create("syzkaller", 0) = 4 [pid 6075] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6076] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6076] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6076] munmap(0x7f6d360cf000, 32768) = 0 [pid 6076] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6076] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6076] ioctl(5, LOOP_CLR_FD) = 0 [pid 6076] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6076] close(5) = 0 [pid 6076] close(4) = 0 [pid 6076] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6075] <... futex resumed>) = 0 [pid 6076] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6075] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6076] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6075] <... futex resumed>) = 0 [pid 6076] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6075] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6076] <... openat resumed>) = 4 [pid 6076] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6075] <... futex resumed>) = 0 [pid 6075] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6076] <... futex resumed>) = 1 [pid 6076] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6075] <... futex resumed>) = 0 [pid 6075] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6076] <... write resumed>) = 12288 [pid 6076] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6075] <... futex resumed>) = 0 [pid 6076] <... futex resumed>) = 1 [pid 6076] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6075] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6076] <... mmap resumed>) = 0x20000000 [pid 6075] <... futex resumed>) = 0 [pid 6076] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6075] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6076] <... futex resumed>) = 0 [pid 6075] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6076] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6075] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6076] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6075] <... futex resumed>) = 0 [pid 6076] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6075] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6076] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6076] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6075] <... futex resumed>) = 0 [pid 6076] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6075] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6076] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6075] <... futex resumed>) = 0 [pid 6076] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6075] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6076] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6075] <... futex resumed>) = 0 [pid 6075] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6076] <... openat resumed>) = 6 [pid 6075] <... mmap resumed>) = 0x7f6d360b6000 [pid 6076] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6075] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6076] <... futex resumed>) = 0 [pid 6075] <... mprotect resumed>) = 0 [pid 6075] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6076] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6075] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6075] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6077 attached => {parent_tid=[6077]}, 88) = 6077 [pid 6075] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6075] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 124.789041][ T6076] loop0: detected capacity change from 0 to 64 [pid 6075] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6077] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6077] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6077] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6077] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6077] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6075] <... futex resumed>) = 0 [pid 6077] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6075] exit_group(0 [pid 6077] <... futex resumed>) = ? [pid 6076] <... futex resumed>) = ? [pid 6075] <... exit_group resumed>) = ? [pid 6077] +++ exited with 0 +++ [pid 6076] +++ exited with 0 +++ [pid 6075] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6075, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./343", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./343", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./343/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./343/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./343/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./343/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./343/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./343/bus") = 0 umount2("./343/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./343/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./343/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./343") = 0 mkdir("./344", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6078 attached , child_tidptr=0x5555564f6750) = 6078 [pid 6078] set_robust_list(0x5555564f6760, 24) = 0 [pid 6078] chdir("./344") = 0 [pid 6078] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6078] setpgid(0, 0) = 0 [pid 6078] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6078] write(3, "1000", 4) = 4 [pid 6078] close(3) = 0 [pid 6078] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6078] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6078] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6078] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6078] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6078] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6078] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6078] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6079 attached => {parent_tid=[6079]}, 88) = 6079 [pid 6079] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6078] rt_sigprocmask(SIG_SETMASK, [], [pid 6079] <... rseq resumed>) = 0 [pid 6079] set_robust_list(0x7f6d468e79a0, 24 [pid 6078] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6079] <... set_robust_list resumed>) = 0 [pid 6078] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6079] rt_sigprocmask(SIG_SETMASK, [], [pid 6078] <... futex resumed>) = 0 [pid 6079] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6079] memfd_create("syzkaller", 0 [pid 6078] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6079] <... memfd_create resumed>) = 3 [pid 6079] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6079] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6079] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6079] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6079] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6079] close(3) = 0 [pid 6079] mkdir("./bus", 0777) = 0 [pid 6079] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6079] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6079] chdir("./bus") = 0 [pid 6079] ioctl(4, LOOP_CLR_FD) = 0 [pid 6079] close(4) = 0 [pid 6079] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6078] <... futex resumed>) = 0 [pid 6079] <... futex resumed>) = 1 [pid 6078] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6079] memfd_create("syzkaller", 0 [pid 6078] <... futex resumed>) = 0 [pid 6078] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6079] <... memfd_create resumed>) = 4 [pid 6079] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6079] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6079] munmap(0x7f6d360cf000, 32768) = 0 [pid 6079] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6079] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6079] ioctl(5, LOOP_CLR_FD) = 0 [pid 6079] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6079] close(5) = 0 [pid 6079] close(4) = 0 [pid 6079] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6079] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6078] <... futex resumed>) = 0 [pid 6078] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6079] <... futex resumed>) = 0 [pid 6079] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6079] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6078] <... futex resumed>) = 1 [pid 6079] <... futex resumed>) = 0 [pid 6078] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6079] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6078] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6078] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6079] <... futex resumed>) = 0 [pid 6078] <... futex resumed>) = 1 [pid 6078] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6079] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6079] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6078] <... futex resumed>) = 0 [pid 6078] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6079] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6078] <... futex resumed>) = 0 [pid 6079] <... mmap resumed>) = 0x20000000 [pid 6078] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6079] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6078] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6079] <... futex resumed>) = 0 [pid 6078] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6079] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6078] <... futex resumed>) = 0 [pid 6079] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6078] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6079] <... openat resumed>) = 5 [pid 6079] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6078] <... futex resumed>) = 0 [pid 6079] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6078] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6079] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6078] <... futex resumed>) = 0 [pid 6079] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6078] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6079] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6078] <... futex resumed>) = 0 [pid 6078] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6079] <... openat resumed>) = 6 [pid 6078] <... mmap resumed>) = 0x7f6d360b6000 [pid 6079] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6079] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6078] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6078] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6078] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6080 attached [pid 6080] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6080] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6080] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6080] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6078] <... clone3 resumed> => {parent_tid=[6080]}, 88) = 6080 [pid 6078] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 124.935021][ T6079] loop0: detected capacity change from 0 to 64 [pid 6078] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6080] <... futex resumed>) = 0 [pid 6080] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6078] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6080] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6080] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6078] <... futex resumed>) = 0 [pid 6080] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6078] exit_group(0 [pid 6080] <... futex resumed>) = ? [pid 6079] <... futex resumed>) = ? [pid 6078] <... exit_group resumed>) = ? [pid 6080] +++ exited with 0 +++ [pid 6079] +++ exited with 0 +++ [pid 6078] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6078, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./344", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./344", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./344/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./344/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./344/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./344/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./344/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./344/bus") = 0 umount2("./344/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./344/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./344/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./344") = 0 mkdir("./345", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6081 attached , child_tidptr=0x5555564f6750) = 6081 [pid 6081] set_robust_list(0x5555564f6760, 24) = 0 [pid 6081] chdir("./345") = 0 [pid 6081] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6081] setpgid(0, 0) = 0 [pid 6081] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6081] write(3, "1000", 4) = 4 [pid 6081] close(3) = 0 [pid 6081] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6081] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6081] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6081] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6081] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6081] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6081] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6081] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6082 attached => {parent_tid=[6082]}, 88) = 6082 [pid 6082] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6081] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6081] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6081] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6082] <... rseq resumed>) = 0 [pid 6082] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6082] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6082] memfd_create("syzkaller", 0) = 3 [pid 6082] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6082] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6082] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6082] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6082] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6082] close(3) = 0 [pid 6082] mkdir("./bus", 0777) = 0 [pid 6082] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6082] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6082] chdir("./bus") = 0 [pid 6082] ioctl(4, LOOP_CLR_FD) = 0 [pid 6082] close(4) = 0 [pid 6082] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6082] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6081] <... futex resumed>) = 0 [pid 6081] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6082] <... futex resumed>) = 0 [pid 6081] <... futex resumed>) = 1 [pid 6082] memfd_create("syzkaller", 0 [pid 6081] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6082] <... memfd_create resumed>) = 4 [pid 6082] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6082] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6082] munmap(0x7f6d360cf000, 32768) = 0 [pid 6082] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6082] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6082] ioctl(5, LOOP_CLR_FD) = 0 [pid 6082] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6082] close(5) = 0 [pid 6082] close(4) = 0 [pid 6082] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6082] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6081] <... futex resumed>) = 0 [pid 6081] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6082] <... futex resumed>) = 0 [pid 6082] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6081] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6082] <... openat resumed>) = 4 [pid 6082] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6081] <... futex resumed>) = 0 [pid 6081] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6081] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6082] <... futex resumed>) = 1 [pid 6082] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6082] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6081] <... futex resumed>) = 0 [pid 6081] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6081] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6082] <... futex resumed>) = 1 [pid 6082] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6082] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6081] <... futex resumed>) = 0 [pid 6082] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6081] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6082] <... futex resumed>) = 0 [pid 6082] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6082] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6081] <... futex resumed>) = 1 [pid 6081] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6082] <... openat resumed>) = 5 [pid 6082] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6081] <... futex resumed>) = 0 [pid 6082] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6081] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6082] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6081] <... futex resumed>) = 0 [pid 6082] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6082] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6081] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6082] <... openat resumed>) = 6 [pid 6081] <... futex resumed>) = 0 [pid 6081] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6082] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6081] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6082] <... futex resumed>) = 0 [pid 6081] <... mprotect resumed>) = 0 [pid 6082] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [ 125.064967][ T6082] loop0: detected capacity change from 0 to 64 [pid 6081] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6081] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6083 attached [pid 6083] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6081] <... clone3 resumed> => {parent_tid=[6083]}, 88) = 6083 [pid 6083] <... rseq resumed>) = 0 [pid 6081] rt_sigprocmask(SIG_SETMASK, [], [pid 6083] set_robust_list(0x7f6d360d69a0, 24 [pid 6081] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6083] <... set_robust_list resumed>) = 0 [pid 6081] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6083] rt_sigprocmask(SIG_SETMASK, [], [pid 6081] <... futex resumed>) = 0 [pid 6083] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6081] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6083] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6083] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6081] <... futex resumed>) = 0 [pid 6083] <... futex resumed>) = 1 [pid 6083] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6081] exit_group(0 [pid 6083] <... futex resumed>) = ? [pid 6082] <... futex resumed>) = ? [pid 6083] +++ exited with 0 +++ [pid 6082] +++ exited with 0 +++ [pid 6081] <... exit_group resumed>) = ? [pid 6081] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6081, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./345", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./345", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./345/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./345/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./345/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./345/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./345/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./345/bus") = 0 umount2("./345/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./345/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./345/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./345") = 0 mkdir("./346", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6084 attached , child_tidptr=0x5555564f6750) = 6084 [pid 6084] set_robust_list(0x5555564f6760, 24) = 0 [pid 6084] chdir("./346") = 0 [pid 6084] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6084] setpgid(0, 0) = 0 [pid 6084] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6084] write(3, "1000", 4) = 4 [pid 6084] close(3) = 0 [pid 6084] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6084] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6084] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6084] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6084] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6084] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6084] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6084] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0} => {parent_tid=[6085]}, 88) = 6085 [pid 6084] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6084] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6084] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 6085 attached [pid 6085] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6085] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6085] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6085] memfd_create("syzkaller", 0) = 3 [pid 6085] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6085] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6085] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6085] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6085] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6085] close(3) = 0 [pid 6085] mkdir("./bus", 0777) = 0 [pid 6085] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6085] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6085] chdir("./bus") = 0 [pid 6085] ioctl(4, LOOP_CLR_FD) = 0 [pid 6085] close(4) = 0 [pid 6085] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6084] <... futex resumed>) = 0 [pid 6085] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6084] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6085] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6084] <... futex resumed>) = 0 [pid 6085] memfd_create("syzkaller", 0 [pid 6084] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6085] <... memfd_create resumed>) = 4 [pid 6085] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6085] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6085] munmap(0x7f6d360cf000, 32768) = 0 [pid 6085] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6085] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6085] ioctl(5, LOOP_CLR_FD) = 0 [pid 6085] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6085] close(5) = 0 [pid 6085] close(4) = 0 [pid 6085] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6084] <... futex resumed>) = 0 [pid 6084] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6084] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6085] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6085] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6084] <... futex resumed>) = 0 [pid 6084] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6085] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6084] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6085] <... write resumed>) = 12288 [pid 6085] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6084] <... futex resumed>) = 0 [pid 6084] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6084] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6085] <... futex resumed>) = 1 [pid 6085] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6085] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6084] <... futex resumed>) = 0 [pid 6084] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6084] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6085] <... futex resumed>) = 1 [pid 6085] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [ 125.183757][ T6085] loop0: detected capacity change from 0 to 64 [pid 6085] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6085] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6084] <... futex resumed>) = 0 [pid 6085] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6084] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6085] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6084] <... futex resumed>) = 0 [pid 6085] <... openat resumed>) = 6 [pid 6084] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6084] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6085] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6085] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6084] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6084] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6084] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6086 attached [pid 6086] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6086] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6086] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6086] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6084] <... clone3 resumed> => {parent_tid=[6086]}, 88) = 6086 [pid 6084] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6084] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6086] <... futex resumed>) = 0 [pid 6086] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6084] <... futex resumed>) = 1 [pid 6086] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6084] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6086] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6084] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6084] exit_group(0 [pid 6086] <... futex resumed>) = ? [pid 6085] <... futex resumed>) = ? [pid 6084] <... exit_group resumed>) = ? [pid 6086] +++ exited with 0 +++ [pid 6085] +++ exited with 0 +++ [pid 6084] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6084, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./346", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./346", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./346/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./346/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./346/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./346/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./346/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./346/bus") = 0 umount2("./346/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./346/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./346/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./346") = 0 mkdir("./347", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6087 ./strace-static-x86_64: Process 6087 attached [pid 6087] set_robust_list(0x5555564f6760, 24) = 0 [pid 6087] chdir("./347") = 0 [pid 6087] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6087] setpgid(0, 0) = 0 [pid 6087] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6087] write(3, "1000", 4) = 4 [pid 6087] close(3) = 0 [pid 6087] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6087] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6087] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6087] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6087] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6087] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6087] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6087] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6088 attached [pid 6088] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6087] <... clone3 resumed> => {parent_tid=[6088]}, 88) = 6088 [pid 6088] <... rseq resumed>) = 0 [pid 6088] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6088] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6088] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6087] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6087] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6088] <... futex resumed>) = 0 [pid 6087] <... futex resumed>) = 1 [pid 6088] memfd_create("syzkaller", 0 [pid 6087] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6088] <... memfd_create resumed>) = 3 [pid 6088] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6088] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6088] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6088] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6088] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6088] close(3) = 0 [pid 6088] mkdir("./bus", 0777) = 0 [pid 6088] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6088] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6088] chdir("./bus") = 0 [pid 6088] ioctl(4, LOOP_CLR_FD) = 0 [pid 6088] close(4) = 0 [pid 6088] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6087] <... futex resumed>) = 0 [pid 6087] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6088] memfd_create("syzkaller", 0 [pid 6087] <... futex resumed>) = 0 [pid 6088] <... memfd_create resumed>) = 4 [pid 6088] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6087] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6088] <... mmap resumed>) = 0x7f6d360cf000 [pid 6088] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6088] munmap(0x7f6d360cf000, 32768) = 0 [pid 6088] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6088] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6088] ioctl(5, LOOP_CLR_FD) = 0 [pid 6088] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6088] close(5) = 0 [pid 6088] close(4) = 0 [pid 6088] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6087] <... futex resumed>) = 0 [pid 6088] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6087] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6088] <... openat resumed>) = 4 [pid 6087] <... futex resumed>) = 0 [pid 6088] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6087] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 6087] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6087] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6088] <... futex resumed>) = 1 [pid 6087] <... futex resumed>) = 0 [pid 6088] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6087] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=49000000} [pid 6088] <... write resumed>) = 12288 [pid 6088] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6087] <... futex resumed>) = 0 [pid 6087] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6087] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6088] <... futex resumed>) = 1 [pid 6088] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6088] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6087] <... futex resumed>) = 0 [pid 6088] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6087] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6088] <... futex resumed>) = 0 [pid 6087] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6088] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [ 125.328730][ T6088] loop0: detected capacity change from 0 to 64 [pid 6088] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6088] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6087] <... futex resumed>) = 0 [pid 6088] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6087] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6088] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6087] <... futex resumed>) = 0 [pid 6087] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6088] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6087] <... futex resumed>) = 0 [pid 6088] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6087] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6088] <... openat resumed>) = 6 [pid 6088] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6087] <... mmap resumed>) = 0x7f6d360b6000 [pid 6088] <... futex resumed>) = 0 [pid 6087] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6088] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6087] <... mprotect resumed>) = 0 [pid 6087] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6087] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6089 attached [pid 6089] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6087] <... clone3 resumed> => {parent_tid=[6089]}, 88) = 6089 [pid 6089] <... rseq resumed>) = 0 [pid 6087] rt_sigprocmask(SIG_SETMASK, [], [pid 6089] set_robust_list(0x7f6d360d69a0, 24 [pid 6087] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6089] <... set_robust_list resumed>) = 0 [pid 6087] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6089] rt_sigprocmask(SIG_SETMASK, [], [pid 6087] <... futex resumed>) = 0 [pid 6089] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6087] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6089] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6089] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6087] <... futex resumed>) = 0 [pid 6089] <... futex resumed>) = 1 [pid 6087] exit_group(0 [pid 6089] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL) = ? [pid 6088] <... futex resumed>) = ? [pid 6089] +++ exited with 0 +++ [pid 6087] <... exit_group resumed>) = ? [pid 6088] +++ exited with 0 +++ [pid 6087] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6087, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./347", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./347", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./347/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./347/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./347/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./347/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./347/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./347/bus") = 0 umount2("./347/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./347/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./347/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./347") = 0 mkdir("./348", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6090 attached , child_tidptr=0x5555564f6750) = 6090 [pid 6090] set_robust_list(0x5555564f6760, 24) = 0 [pid 6090] chdir("./348") = 0 [pid 6090] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6090] setpgid(0, 0) = 0 [pid 6090] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6090] write(3, "1000", 4) = 4 [pid 6090] close(3) = 0 [pid 6090] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6090] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6090] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6090] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6090] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6090] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6090] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6090] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6091 attached [pid 6091] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6090] <... clone3 resumed> => {parent_tid=[6091]}, 88) = 6091 [pid 6091] <... rseq resumed>) = 0 [pid 6091] set_robust_list(0x7f6d468e79a0, 24 [pid 6090] rt_sigprocmask(SIG_SETMASK, [], [pid 6091] <... set_robust_list resumed>) = 0 [pid 6091] rt_sigprocmask(SIG_SETMASK, [], [pid 6090] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6091] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6090] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6091] memfd_create("syzkaller", 0 [pid 6090] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6091] <... memfd_create resumed>) = 3 [pid 6091] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6091] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6091] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6091] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6091] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6091] close(3) = 0 [pid 6091] mkdir("./bus", 0777) = 0 [pid 6091] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6091] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6091] chdir("./bus") = 0 [pid 6091] ioctl(4, LOOP_CLR_FD) = 0 [pid 6091] close(4) = 0 [pid 6091] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6091] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6090] <... futex resumed>) = 0 [pid 6090] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6091] <... futex resumed>) = 0 [pid 6090] <... futex resumed>) = 1 [pid 6091] memfd_create("syzkaller", 0 [pid 6090] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6091] <... memfd_create resumed>) = 4 [pid 6091] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6091] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6091] munmap(0x7f6d360cf000, 32768) = 0 [pid 6091] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6091] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6091] ioctl(5, LOOP_CLR_FD) = 0 [pid 6091] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6091] close(5) = 0 [pid 6091] close(4) = 0 [pid 6091] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6090] <... futex resumed>) = 0 [pid 6090] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6091] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6090] <... futex resumed>) = 0 [pid 6090] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6091] <... openat resumed>) = 4 [pid 6091] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6090] <... futex resumed>) = 0 [pid 6091] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6090] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6091] <... write resumed>) = 12288 [pid 6091] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6090] <... futex resumed>) = 0 [pid 6091] <... futex resumed>) = 0 [pid 6090] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6091] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6090] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6091] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6090] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6091] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6090] <... futex resumed>) = 0 [pid 6091] <... mmap resumed>) = 0x20000000 [pid 6090] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6091] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6090] <... futex resumed>) = 0 [pid 6091] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6090] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6091] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6090] <... futex resumed>) = 0 [pid 6091] <... openat resumed>) = 5 [pid 6090] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6091] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6090] <... futex resumed>) = 0 [pid 6090] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6090] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6091] <... futex resumed>) = 1 [pid 6090] <... futex resumed>) = 0 [pid 6091] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6090] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6091] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6090] <... mmap resumed>) = 0x7f6d360b6000 [pid 6091] <... openat resumed>) = 6 [pid 6090] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6090] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6091] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6090] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6092 attached [pid 6092] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6090] <... clone3 resumed> => {parent_tid=[6092]}, 88) = 6092 [pid 6092] <... rseq resumed>) = 0 [pid 6092] set_robust_list(0x7f6d360d69a0, 24 [pid 6090] rt_sigprocmask(SIG_SETMASK, [], [pid 6092] <... set_robust_list resumed>) = 0 [pid 6090] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6092] rt_sigprocmask(SIG_SETMASK, [], [pid 6090] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6092] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6090] <... futex resumed>) = 0 [pid 6092] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6090] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6091] <... futex resumed>) = 0 [pid 6092] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6091] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6092] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6090] <... futex resumed>) = 0 [pid 6092] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6090] exit_group(0 [pid 6092] <... futex resumed>) = ? [pid 6091] <... futex resumed>) = ? [pid 6090] <... exit_group resumed>) = ? [ 125.479873][ T6091] loop0: detected capacity change from 0 to 64 [pid 6091] +++ exited with 0 +++ [pid 6092] +++ exited with 0 +++ [pid 6090] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6090, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./348", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./348", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./348/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./348/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./348/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./348/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./348/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./348/bus") = 0 umount2("./348/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./348/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./348/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./348") = 0 mkdir("./349", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6093 attached , child_tidptr=0x5555564f6750) = 6093 [pid 6093] set_robust_list(0x5555564f6760, 24) = 0 [pid 6093] chdir("./349") = 0 [pid 6093] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6093] setpgid(0, 0) = 0 [pid 6093] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6093] write(3, "1000", 4) = 4 [pid 6093] close(3) = 0 [pid 6093] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6093] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6093] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6093] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6093] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6093] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6093] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6093] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6094 attached [pid 6094] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6093] <... clone3 resumed> => {parent_tid=[6094]}, 88) = 6094 [pid 6094] set_robust_list(0x7f6d468e79a0, 24 [pid 6093] rt_sigprocmask(SIG_SETMASK, [], [pid 6094] <... set_robust_list resumed>) = 0 [pid 6094] rt_sigprocmask(SIG_SETMASK, [], [pid 6093] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6094] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6093] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6094] memfd_create("syzkaller", 0 [pid 6093] <... futex resumed>) = 0 [pid 6094] <... memfd_create resumed>) = 3 [pid 6094] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6093] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6094] <... mmap resumed>) = 0x7f6d3e4c7000 [pid 6094] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6094] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6094] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6094] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6094] close(3) = 0 [pid 6094] mkdir("./bus", 0777) = 0 [pid 6094] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6094] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6094] chdir("./bus") = 0 [pid 6094] ioctl(4, LOOP_CLR_FD) = 0 [pid 6094] close(4) = 0 [pid 6094] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6093] <... futex resumed>) = 0 [pid 6094] memfd_create("syzkaller", 0 [pid 6093] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6094] <... memfd_create resumed>) = 4 [pid 6093] <... futex resumed>) = 0 [pid 6093] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6094] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6094] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6094] munmap(0x7f6d360cf000, 32768) = 0 [pid 6094] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6094] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6094] ioctl(5, LOOP_CLR_FD) = 0 [pid 6094] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6094] close(5) = 0 [pid 6094] close(4) = 0 [pid 6094] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6093] <... futex resumed>) = 0 [pid 6094] <... futex resumed>) = 1 [pid 6093] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6094] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6093] <... futex resumed>) = 0 [pid 6093] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6094] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6093] <... futex resumed>) = 0 [pid 6094] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6093] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6094] <... write resumed>) = 12288 [pid 6093] <... futex resumed>) = 0 [pid 6093] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6094] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6093] <... futex resumed>) = 0 [pid 6093] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6093] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6094] <... futex resumed>) = 1 [pid 6094] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6094] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6093] <... futex resumed>) = 0 [pid 6093] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6094] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6093] <... futex resumed>) = 0 [pid 6093] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6094] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6094] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6093] <... futex resumed>) = 0 [pid 6094] <... futex resumed>) = 1 [pid 6093] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6094] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6093] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6094] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6093] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6094] <... openat resumed>) = 6 [pid 6093] <... mmap resumed>) = 0x7f6d360b6000 [pid 6093] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6094] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6093] <... mprotect resumed>) = 0 [pid 6094] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6093] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6093] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6095 attached [pid 6095] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6093] <... clone3 resumed> => {parent_tid=[6095]}, 88) = 6095 [pid 6095] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6093] rt_sigprocmask(SIG_SETMASK, [], [pid 6095] rt_sigprocmask(SIG_SETMASK, [], [pid 6093] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6095] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6093] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6095] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6093] <... futex resumed>) = 0 [pid 6095] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6095] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6093] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6095] <... futex resumed>) = 0 [pid 6093] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6095] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6093] exit_group(0 [pid 6095] <... futex resumed>) = ? [pid 6093] <... exit_group resumed>) = ? [pid 6094] <... futex resumed>) = ? [pid 6095] +++ exited with 0 +++ [pid 6094] +++ exited with 0 +++ [pid 6093] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6093, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [ 125.614012][ T6094] loop0: detected capacity change from 0 to 64 restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./349", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./349", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./349/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./349/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./349/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./349/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./349/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./349/bus") = 0 umount2("./349/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./349/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./349/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./349") = 0 mkdir("./350", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6096 ./strace-static-x86_64: Process 6096 attached [pid 6096] set_robust_list(0x5555564f6760, 24) = 0 [pid 6096] chdir("./350") = 0 [pid 6096] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6096] setpgid(0, 0) = 0 [pid 6096] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6096] write(3, "1000", 4) = 4 [pid 6096] close(3) = 0 [pid 6096] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6096] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6096] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6096] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6096] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6096] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6096] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6096] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6097 attached [pid 6097] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6097] set_robust_list(0x7f6d468e79a0, 24 [pid 6096] <... clone3 resumed> => {parent_tid=[6097]}, 88) = 6097 [pid 6097] <... set_robust_list resumed>) = 0 [pid 6097] rt_sigprocmask(SIG_SETMASK, [], [pid 6096] rt_sigprocmask(SIG_SETMASK, [], [pid 6097] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6096] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6097] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6096] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6097] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6096] <... futex resumed>) = 0 [pid 6097] memfd_create("syzkaller", 0 [pid 6096] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6097] <... memfd_create resumed>) = 3 [pid 6097] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6097] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6097] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6097] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6097] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6097] close(3) = 0 [pid 6097] mkdir("./bus", 0777) = 0 [pid 6097] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6097] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6097] chdir("./bus") = 0 [pid 6097] ioctl(4, LOOP_CLR_FD) = 0 [pid 6097] close(4) = 0 [pid 6097] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6097] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6096] <... futex resumed>) = 0 [pid 6096] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6096] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6097] <... futex resumed>) = 0 [pid 6097] memfd_create("syzkaller", 0) = 4 [pid 6097] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6097] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6097] munmap(0x7f6d360cf000, 32768) = 0 [pid 6097] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6097] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6097] ioctl(5, LOOP_CLR_FD) = 0 [pid 6097] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6097] close(5) = 0 [pid 6097] close(4) = 0 [pid 6097] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6096] <... futex resumed>) = 0 [pid 6097] <... futex resumed>) = 1 [pid 6097] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6096] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6097] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6096] <... futex resumed>) = 0 [pid 6097] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6096] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6097] <... openat resumed>) = 4 [pid 6097] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6096] <... futex resumed>) = 0 [pid 6097] <... futex resumed>) = 1 [pid 6097] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6096] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6097] <... write resumed>) = 12288 [pid 6096] <... futex resumed>) = 0 [pid 6096] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6097] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6096] <... futex resumed>) = 0 [pid 6096] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6096] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6097] <... futex resumed>) = 1 [pid 6097] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6097] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6096] <... futex resumed>) = 0 [pid 6096] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6097] <... futex resumed>) = 1 [pid 6096] <... futex resumed>) = 0 [pid 6097] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6096] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6097] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6097] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6096] <... futex resumed>) = 0 [pid 6097] <... futex resumed>) = 1 [pid 6097] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6096] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6097] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6097] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6096] <... futex resumed>) = 0 [pid 6096] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6097] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6096] <... futex resumed>) = 0 [pid 6097] <... openat resumed>) = 6 [pid 6096] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6096] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6097] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6096] <... mprotect resumed>) = 0 [pid 6097] <... futex resumed>) = 0 [pid 6097] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6096] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6096] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6098 attached => {parent_tid=[6098]}, 88) = 6098 [pid 6096] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6096] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6096] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6098] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6098] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6098] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6098] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6098] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6096] <... futex resumed>) = 0 [ 125.747990][ T6097] loop0: detected capacity change from 0 to 64 [pid 6098] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6096] exit_group(0 [pid 6098] <... futex resumed>) = ? [pid 6097] <... futex resumed>) = ? [pid 6098] +++ exited with 0 +++ [pid 6097] +++ exited with 0 +++ [pid 6096] <... exit_group resumed>) = ? [pid 6096] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6096, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./350", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./350", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./350/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./350/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./350/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./350/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./350/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./350/bus") = 0 umount2("./350/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./350/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./350/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./350") = 0 mkdir("./351", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6099 ./strace-static-x86_64: Process 6099 attached [pid 6099] set_robust_list(0x5555564f6760, 24) = 0 [pid 6099] chdir("./351") = 0 [pid 6099] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6099] setpgid(0, 0) = 0 [pid 6099] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6099] write(3, "1000", 4) = 4 [pid 6099] close(3) = 0 [pid 6099] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6099] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6099] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6099] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6099] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6099] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6099] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6099] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6100 attached => {parent_tid=[6100]}, 88) = 6100 [pid 6099] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6099] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6099] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6100] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6100] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6100] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6100] memfd_create("syzkaller", 0) = 3 [pid 6100] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6100] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6100] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6100] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6100] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6100] close(3) = 0 [pid 6100] mkdir("./bus", 0777) = 0 [pid 6100] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6100] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6100] chdir("./bus") = 0 [pid 6100] ioctl(4, LOOP_CLR_FD) = 0 [pid 6100] close(4) = 0 [pid 6100] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6099] <... futex resumed>) = 0 [pid 6100] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6099] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6100] <... futex resumed>) = 0 [pid 6099] <... futex resumed>) = 1 [pid 6099] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6100] memfd_create("syzkaller", 0) = 4 [pid 6100] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6100] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6100] munmap(0x7f6d360cf000, 32768) = 0 [pid 6100] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6100] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6100] ioctl(5, LOOP_CLR_FD) = 0 [pid 6100] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6100] close(5) = 0 [pid 6100] close(4) = 0 [pid 6100] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6099] <... futex resumed>) = 0 [pid 6100] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6099] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6100] <... futex resumed>) = 0 [pid 6099] <... futex resumed>) = 1 [pid 6100] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6099] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6100] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6099] <... futex resumed>) = 0 [pid 6099] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6100] <... futex resumed>) = 1 [pid 6099] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6100] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [ 125.874717][ T6100] loop0: detected capacity change from 0 to 64 [pid 6100] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6099] <... futex resumed>) = 0 [pid 6100] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6099] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6100] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6099] <... futex resumed>) = 0 [pid 6100] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6099] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6100] <... mmap resumed>) = 0x20000000 [pid 6100] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6100] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6099] <... futex resumed>) = 0 [pid 6099] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6100] <... futex resumed>) = 0 [pid 6100] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6100] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6099] <... futex resumed>) = 1 [pid 6100] <... openat resumed>) = 5 [pid 6099] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6100] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6099] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6099] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6100] <... futex resumed>) = 0 [pid 6099] <... futex resumed>) = 0 [pid 6099] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6099] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6100] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6099] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6100] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6099] <... mprotect resumed>) = 0 [pid 6099] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6099] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6100] <... openat resumed>) = 6 [pid 6099] <... clone3 resumed> => {parent_tid=[6101]}, 88) = 6101 [pid 6099] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6099] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6099] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 6101 attached [pid 6100] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6100] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6101] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6101] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6101] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6101] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6101] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6099] <... futex resumed>) = 0 [pid 6101] <... futex resumed>) = 1 [pid 6099] exit_group(0 [pid 6101] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL) = ? [pid 6100] <... futex resumed>) = ? [pid 6101] +++ exited with 0 +++ [pid 6100] +++ exited with 0 +++ [pid 6099] <... exit_group resumed>) = ? [pid 6099] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6099, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./351", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./351", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./351/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./351/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./351/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./351/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./351/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./351/bus") = 0 umount2("./351/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./351/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./351/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./351") = 0 mkdir("./352", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6102 ./strace-static-x86_64: Process 6102 attached [pid 6102] set_robust_list(0x5555564f6760, 24) = 0 [pid 6102] chdir("./352") = 0 [pid 6102] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6102] setpgid(0, 0) = 0 [pid 6102] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6102] write(3, "1000", 4) = 4 [pid 6102] close(3) = 0 [pid 6102] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6102] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6102] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6102] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6102] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6102] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6102] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6102] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6103 attached => {parent_tid=[6103]}, 88) = 6103 [pid 6103] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6102] rt_sigprocmask(SIG_SETMASK, [], [pid 6103] set_robust_list(0x7f6d468e79a0, 24 [pid 6102] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6103] <... set_robust_list resumed>) = 0 [pid 6102] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6103] rt_sigprocmask(SIG_SETMASK, [], [pid 6102] <... futex resumed>) = 0 [pid 6103] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6102] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6103] memfd_create("syzkaller", 0) = 3 [pid 6103] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6103] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6103] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6103] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6103] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6103] close(3) = 0 [pid 6103] mkdir("./bus", 0777) = 0 [pid 6103] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6103] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6103] chdir("./bus") = 0 [pid 6103] ioctl(4, LOOP_CLR_FD) = 0 [pid 6103] close(4) = 0 [pid 6103] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6102] <... futex resumed>) = 0 [pid 6102] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6103] <... futex resumed>) = 1 [pid 6102] <... futex resumed>) = 0 [pid 6103] memfd_create("syzkaller", 0 [pid 6102] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6103] <... memfd_create resumed>) = 4 [pid 6103] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6103] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6103] munmap(0x7f6d360cf000, 32768) = 0 [pid 6103] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6103] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6103] ioctl(5, LOOP_CLR_FD) = 0 [pid 6103] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6103] close(5) = 0 [pid 6103] close(4) = 0 [pid 6103] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6102] <... futex resumed>) = 0 [pid 6103] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6102] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6103] <... openat resumed>) = 4 [pid 6102] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6103] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6102] <... futex resumed>) = 0 [pid 6102] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6102] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6103] <... futex resumed>) = 1 [pid 6103] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6103] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6102] <... futex resumed>) = 0 [pid 6102] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6103] <... futex resumed>) = 1 [pid 6103] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6102] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6103] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6102] <... futex resumed>) = 0 [pid 6103] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6102] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6103] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6102] <... futex resumed>) = 0 [pid 6103] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6102] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6103] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6103] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6102] <... futex resumed>) = 0 [pid 6102] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6103] <... futex resumed>) = 1 [pid 6102] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6103] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6102] <... futex resumed>) = 0 [pid 6103] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6102] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6103] <... openat resumed>) = 6 [pid 6102] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6103] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6103] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6102] <... mprotect resumed>) = 0 [pid 6102] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6102] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6104 attached [pid 6104] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6104] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6104] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 126.022323][ T6103] loop0: detected capacity change from 0 to 64 [pid 6104] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6102] <... clone3 resumed> => {parent_tid=[6104]}, 88) = 6104 [pid 6102] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6102] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6104] <... futex resumed>) = 0 [pid 6102] <... futex resumed>) = 1 [pid 6104] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6102] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6104] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6104] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6102] <... futex resumed>) = 0 [pid 6104] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6102] exit_group(0 [pid 6103] <... futex resumed>) = ? [pid 6102] <... exit_group resumed>) = ? [pid 6104] <... futex resumed>) = ? [pid 6104] +++ exited with 0 +++ [pid 6103] +++ exited with 0 +++ [pid 6102] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6102, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./352", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./352", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./352/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./352/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./352/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./352/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./352/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./352/bus") = 0 umount2("./352/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./352/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./352/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./352") = 0 mkdir("./353", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6105 attached , child_tidptr=0x5555564f6750) = 6105 [pid 6105] set_robust_list(0x5555564f6760, 24) = 0 [pid 6105] chdir("./353") = 0 [pid 6105] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6105] setpgid(0, 0) = 0 [pid 6105] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6105] write(3, "1000", 4) = 4 [pid 6105] close(3) = 0 [pid 6105] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6105] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6105] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6105] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6105] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6105] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6105] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6105] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6106 attached => {parent_tid=[6106]}, 88) = 6106 [pid 6106] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6105] rt_sigprocmask(SIG_SETMASK, [], [pid 6106] set_robust_list(0x7f6d468e79a0, 24 [pid 6105] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6106] <... set_robust_list resumed>) = 0 [pid 6106] rt_sigprocmask(SIG_SETMASK, [], [pid 6105] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6106] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6105] <... futex resumed>) = 0 [pid 6106] memfd_create("syzkaller", 0 [pid 6105] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6106] <... memfd_create resumed>) = 3 [pid 6106] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6106] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6106] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6106] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6106] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6106] close(3) = 0 [pid 6106] mkdir("./bus", 0777) = 0 [pid 6106] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6106] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6106] chdir("./bus") = 0 [pid 6106] ioctl(4, LOOP_CLR_FD) = 0 [pid 6106] close(4) = 0 [pid 6106] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6105] <... futex resumed>) = 0 [pid 6106] <... futex resumed>) = 1 [pid 6105] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6105] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6106] memfd_create("syzkaller", 0) = 4 [pid 6106] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6106] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6106] munmap(0x7f6d360cf000, 32768) = 0 [pid 6106] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6106] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6106] ioctl(5, LOOP_CLR_FD) = 0 [pid 6106] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6106] close(5) = 0 [pid 6106] close(4) = 0 [pid 6106] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6105] <... futex resumed>) = 0 [pid 6105] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6106] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6105] <... futex resumed>) = 0 [pid 6105] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6106] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6105] <... futex resumed>) = 0 [pid 6105] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6106] <... futex resumed>) = 1 [pid 6105] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6106] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6106] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6105] <... futex resumed>) = 0 [pid 6105] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6106] <... futex resumed>) = 1 [pid 6105] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6106] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6106] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6105] <... futex resumed>) = 0 [pid 6106] <... futex resumed>) = 1 [ 126.142131][ T6106] loop0: detected capacity change from 0 to 64 [pid 6105] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6106] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6105] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6106] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6106] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6105] <... futex resumed>) = 0 [pid 6105] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6105] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6105] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6106] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6106] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6105] <... mmap resumed>) = 0x7f6d360b6000 [pid 6105] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6106] <... openat resumed>) = 6 [pid 6105] <... mprotect resumed>) = 0 [pid 6106] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6105] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6106] <... futex resumed>) = 0 [pid 6105] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6106] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 6107 attached [pid 6105] <... clone3 resumed> => {parent_tid=[6107]}, 88) = 6107 [pid 6107] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6105] rt_sigprocmask(SIG_SETMASK, [], [pid 6107] <... rseq resumed>) = 0 [pid 6107] set_robust_list(0x7f6d360d69a0, 24 [pid 6105] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6107] <... set_robust_list resumed>) = 0 [pid 6105] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6107] rt_sigprocmask(SIG_SETMASK, [], [pid 6105] <... futex resumed>) = 0 [pid 6107] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6105] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6107] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6107] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6105] <... futex resumed>) = 0 [pid 6107] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6105] exit_group(0 [pid 6106] <... futex resumed>) = ? [pid 6105] <... exit_group resumed>) = ? [pid 6107] <... futex resumed>) = ? [pid 6106] +++ exited with 0 +++ [pid 6107] +++ exited with 0 +++ [pid 6105] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6105, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./353", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./353", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./353/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./353/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./353/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./353/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./353/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./353/bus") = 0 umount2("./353/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./353/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./353/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./353") = 0 mkdir("./354", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6108 ./strace-static-x86_64: Process 6108 attached [pid 6108] set_robust_list(0x5555564f6760, 24) = 0 [pid 6108] chdir("./354") = 0 [pid 6108] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6108] setpgid(0, 0) = 0 [pid 6108] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6108] write(3, "1000", 4) = 4 [pid 6108] close(3) = 0 [pid 6108] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6108] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6108] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6108] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6108] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6108] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6108] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6108] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6109 attached [pid 6109] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6108] <... clone3 resumed> => {parent_tid=[6109]}, 88) = 6109 [pid 6109] <... rseq resumed>) = 0 [pid 6108] rt_sigprocmask(SIG_SETMASK, [], [pid 6109] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6108] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6109] rt_sigprocmask(SIG_SETMASK, [], [pid 6108] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6109] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6108] <... futex resumed>) = 0 [pid 6109] memfd_create("syzkaller", 0 [pid 6108] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6109] <... memfd_create resumed>) = 3 [pid 6109] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6109] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6109] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6109] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6109] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6109] close(3) = 0 [pid 6109] mkdir("./bus", 0777) = 0 [pid 6109] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6109] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6109] chdir("./bus") = 0 [pid 6109] ioctl(4, LOOP_CLR_FD) = 0 [pid 6109] close(4) = 0 [pid 6109] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6109] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6108] <... futex resumed>) = 0 [pid 6108] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6109] <... futex resumed>) = 0 [pid 6108] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6109] memfd_create("syzkaller", 0) = 4 [pid 6109] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6109] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6109] munmap(0x7f6d360cf000, 32768) = 0 [pid 6109] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6109] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6109] ioctl(5, LOOP_CLR_FD) = 0 [pid 6109] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6109] close(5) = 0 [pid 6109] close(4) = 0 [pid 6109] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6109] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6108] <... futex resumed>) = 0 [pid 6108] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6109] <... futex resumed>) = 0 [pid 6108] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6109] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6109] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6108] <... futex resumed>) = 0 [pid 6109] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6108] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6109] <... futex resumed>) = 0 [pid 6108] <... futex resumed>) = 1 [pid 6109] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6108] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6109] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6108] <... futex resumed>) = 0 [pid 6109] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6108] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6109] <... futex resumed>) = 0 [pid 6109] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6108] <... futex resumed>) = 1 [pid 6108] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6109] <... mmap resumed>) = 0x20000000 [pid 6109] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6108] <... futex resumed>) = 0 [pid 6109] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 6108] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6109] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6109] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6108] <... futex resumed>) = 0 [pid 6109] <... openat resumed>) = 5 [pid 6108] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6109] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6108] <... futex resumed>) = 0 [pid 6108] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6108] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6108] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6109] <... futex resumed>) = 1 [pid 6108] <... mmap resumed>) = 0x7f6d360b6000 [pid 6109] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6109] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [pid 6108] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [ 126.284020][ T6109] loop0: detected capacity change from 0 to 64 [pid 6109] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6109] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6108] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6108] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6110 attached [pid 6110] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6108] <... clone3 resumed> => {parent_tid=[6110]}, 88) = 6110 [pid 6108] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6110] <... rseq resumed>) = 0 [pid 6108] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6110] set_robust_list(0x7f6d360d69a0, 24 [pid 6108] <... futex resumed>) = 0 [pid 6110] <... set_robust_list resumed>) = 0 [pid 6110] rt_sigprocmask(SIG_SETMASK, [], [pid 6108] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6110] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6110] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6110] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6108] <... futex resumed>) = 0 [pid 6110] <... futex resumed>) = 1 [pid 6108] exit_group(0 [pid 6110] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6109] <... futex resumed>) = ? [pid 6110] <... futex resumed>) = ? [pid 6109] +++ exited with 0 +++ [pid 6108] <... exit_group resumed>) = ? [pid 6110] +++ exited with 0 +++ [pid 6108] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6108, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./354", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./354", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./354/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./354/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./354/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./354/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./354/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./354/bus") = 0 umount2("./354/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./354/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./354/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./354") = 0 mkdir("./355", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6111 attached , child_tidptr=0x5555564f6750) = 6111 [pid 6111] set_robust_list(0x5555564f6760, 24) = 0 [pid 6111] chdir("./355") = 0 [pid 6111] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6111] setpgid(0, 0) = 0 [pid 6111] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6111] write(3, "1000", 4) = 4 [pid 6111] close(3) = 0 [pid 6111] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6111] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6111] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6111] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6111] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6111] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6111] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6111] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6112 attached [pid 6112] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6111] <... clone3 resumed> => {parent_tid=[6112]}, 88) = 6112 [pid 6111] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6111] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6112] <... rseq resumed>) = 0 [pid 6111] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6112] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6112] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6112] memfd_create("syzkaller", 0) = 3 [pid 6112] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6112] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6112] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6112] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6112] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6112] close(3) = 0 [pid 6112] mkdir("./bus", 0777) = 0 [pid 6112] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6112] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6112] chdir("./bus") = 0 [pid 6112] ioctl(4, LOOP_CLR_FD) = 0 [pid 6112] close(4) = 0 [pid 6112] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6112] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6111] <... futex resumed>) = 0 [pid 6111] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6112] <... futex resumed>) = 0 [pid 6111] <... futex resumed>) = 1 [pid 6112] memfd_create("syzkaller", 0 [pid 6111] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6112] <... memfd_create resumed>) = 4 [pid 6112] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6112] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6112] munmap(0x7f6d360cf000, 32768) = 0 [pid 6112] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6112] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6112] ioctl(5, LOOP_CLR_FD) = 0 [pid 6112] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6112] close(5) = 0 [pid 6112] close(4) = 0 [pid 6112] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6111] <... futex resumed>) = 0 [pid 6111] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6112] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6111] <... futex resumed>) = 0 [pid 6112] <... openat resumed>) = 4 [pid 6111] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6112] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6111] <... futex resumed>) = 0 [pid 6111] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6112] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6111] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6112] <... write resumed>) = 12288 [pid 6112] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6111] <... futex resumed>) = 0 [pid 6112] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6111] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6112] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6111] <... futex resumed>) = 0 [pid 6112] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6111] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6112] <... mmap resumed>) = 0x20000000 [pid 6112] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6111] <... futex resumed>) = 0 [pid 6112] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6111] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6112] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6111] <... futex resumed>) = 0 [pid 6112] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6111] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 126.412259][ T6112] loop0: detected capacity change from 0 to 64 [pid 6112] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6112] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6111] <... futex resumed>) = 0 [pid 6112] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 6111] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6112] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6111] <... futex resumed>) = 0 [pid 6112] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6111] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6111] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6112] <... openat resumed>) = 6 [pid 6112] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6111] <... mmap resumed>) = 0x7f6d360b6000 [pid 6112] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6111] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6111] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6111] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6113 attached [pid 6113] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6111] <... clone3 resumed> => {parent_tid=[6113]}, 88) = 6113 [pid 6113] <... rseq resumed>) = 0 [pid 6113] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6111] rt_sigprocmask(SIG_SETMASK, [], [pid 6113] rt_sigprocmask(SIG_SETMASK, [], [pid 6111] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6113] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6111] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6113] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6111] <... futex resumed>) = 0 [pid 6113] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6111] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6113] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6111] <... futex resumed>) = 0 [pid 6113] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6111] exit_group(0 [pid 6112] <... futex resumed>) = ? [pid 6111] <... exit_group resumed>) = ? [pid 6113] <... futex resumed>) = ? [pid 6113] +++ exited with 0 +++ [pid 6112] +++ exited with 0 +++ [pid 6111] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6111, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./355", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./355", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./355/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./355/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./355/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./355/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./355/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./355/bus") = 0 umount2("./355/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./355/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./355/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./355") = 0 mkdir("./356", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6114 attached , child_tidptr=0x5555564f6750) = 6114 [pid 6114] set_robust_list(0x5555564f6760, 24) = 0 [pid 6114] chdir("./356") = 0 [pid 6114] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6114] setpgid(0, 0) = 0 [pid 6114] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6114] write(3, "1000", 4) = 4 [pid 6114] close(3) = 0 [pid 6114] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6114] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6114] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6114] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6114] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6114] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6114] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6114] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6115 attached => {parent_tid=[6115]}, 88) = 6115 [pid 6114] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6114] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6114] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6115] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6115] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6115] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6115] memfd_create("syzkaller", 0) = 3 [pid 6115] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6115] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6115] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6115] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6115] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6115] close(3) = 0 [pid 6115] mkdir("./bus", 0777) = 0 [pid 6115] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6115] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6115] chdir("./bus") = 0 [pid 6115] ioctl(4, LOOP_CLR_FD) = 0 [pid 6115] close(4) = 0 [pid 6115] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6114] <... futex resumed>) = 0 [pid 6115] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6114] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6115] <... futex resumed>) = 0 [pid 6114] <... futex resumed>) = 1 [pid 6115] memfd_create("syzkaller", 0 [pid 6114] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6115] <... memfd_create resumed>) = 4 [pid 6115] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6115] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6115] munmap(0x7f6d360cf000, 32768) = 0 [pid 6115] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6115] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6115] ioctl(5, LOOP_CLR_FD) = 0 [pid 6115] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6115] close(5) = 0 [pid 6115] close(4) = 0 [pid 6115] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6114] <... futex resumed>) = 0 [pid 6114] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6114] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6115] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6115] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6115] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6114] <... futex resumed>) = 0 [pid 6114] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6115] <... futex resumed>) = 0 [pid 6114] <... futex resumed>) = 1 [pid 6114] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6115] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [ 126.558918][ T6115] loop0: detected capacity change from 0 to 64 [pid 6115] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6114] <... futex resumed>) = 0 [pid 6115] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6114] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6114] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6115] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6115] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6115] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6114] <... futex resumed>) = 0 [pid 6115] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6114] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6115] <... futex resumed>) = 0 [pid 6114] <... futex resumed>) = 1 [pid 6114] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6115] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6115] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6115] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6114] <... futex resumed>) = 0 [pid 6115] <... futex resumed>) = 1 [pid 6114] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6115] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6114] <... futex resumed>) = 0 [pid 6115] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6114] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6115] <... openat resumed>) = 6 [pid 6114] <... futex resumed>) = 0 [pid 6115] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6114] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6115] <... futex resumed>) = 0 [pid 6115] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6114] <... mmap resumed>) = 0x7f6d360b6000 [pid 6114] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6114] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6114] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6116 attached [pid 6116] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6114] <... clone3 resumed> => {parent_tid=[6116]}, 88) = 6116 [pid 6114] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6114] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6114] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6116] <... rseq resumed>) = 0 [pid 6116] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6116] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6116] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6116] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6114] <... futex resumed>) = 0 [pid 6116] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6114] exit_group(0 [pid 6116] <... futex resumed>) = ? [pid 6116] +++ exited with 0 +++ [pid 6115] <... futex resumed>) = ? [pid 6114] <... exit_group resumed>) = ? [pid 6115] +++ exited with 0 +++ [pid 6114] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6114, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./356", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./356", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./356/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./356/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./356/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./356/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./356/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./356/bus") = 0 umount2("./356/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./356/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./356/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./356") = 0 mkdir("./357", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6117 ./strace-static-x86_64: Process 6117 attached [pid 6117] set_robust_list(0x5555564f6760, 24) = 0 [pid 6117] chdir("./357") = 0 [pid 6117] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6117] setpgid(0, 0) = 0 [pid 6117] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6117] write(3, "1000", 4) = 4 [pid 6117] close(3) = 0 [pid 6117] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6117] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6117] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6117] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6117] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6117] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6117] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6117] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6118 attached [pid 6118] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6118] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6118] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6118] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6117] <... clone3 resumed> => {parent_tid=[6118]}, 88) = 6118 [pid 6117] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6117] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6118] <... futex resumed>) = 0 [pid 6117] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6118] memfd_create("syzkaller", 0) = 3 [pid 6118] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6118] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6118] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6118] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6118] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6118] close(3) = 0 [pid 6118] mkdir("./bus", 0777) = 0 [pid 6118] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6118] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6118] chdir("./bus") = 0 [pid 6118] ioctl(4, LOOP_CLR_FD) = 0 [pid 6118] close(4) = 0 [pid 6118] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6117] <... futex resumed>) = 0 [pid 6117] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6118] memfd_create("syzkaller", 0) = 4 [pid 6117] <... futex resumed>) = 0 [pid 6117] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6118] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6118] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6118] munmap(0x7f6d360cf000, 32768) = 0 [pid 6118] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6118] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6118] ioctl(5, LOOP_CLR_FD) = 0 [pid 6118] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6118] close(5) = 0 [pid 6118] close(4) = 0 [pid 6118] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6117] <... futex resumed>) = 0 [pid 6118] <... futex resumed>) = 1 [pid 6118] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 6117] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6118] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6117] <... futex resumed>) = 0 [pid 6117] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6118] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6117] <... futex resumed>) = 0 [pid 6117] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6117] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6118] <... futex resumed>) = 1 [pid 6118] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6118] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6117] <... futex resumed>) = 0 [pid 6118] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6117] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6118] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6117] <... futex resumed>) = 0 [pid 6118] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6117] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6118] <... mmap resumed>) = 0x20000000 [pid 6118] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6117] <... futex resumed>) = 0 [pid 6118] <... futex resumed>) = 1 [pid 6117] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6118] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6117] <... futex resumed>) = 0 [pid 6117] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6118] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6118] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6117] <... futex resumed>) = 0 [pid 6118] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6117] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6118] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6117] <... futex resumed>) = 0 [pid 6118] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6117] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6118] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6117] <... futex resumed>) = 0 [pid 6117] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6118] <... openat resumed>) = 6 [pid 6117] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6118] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6117] <... mprotect resumed>) = 0 [ 126.717536][ T6118] loop0: detected capacity change from 0 to 64 [pid 6118] <... futex resumed>) = 0 [pid 6118] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6117] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6117] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6119 attached [pid 6119] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6119] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6119] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6119] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6117] <... clone3 resumed> => {parent_tid=[6119]}, 88) = 6119 [pid 6117] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6117] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6119] <... futex resumed>) = 0 [pid 6117] <... futex resumed>) = 1 [pid 6119] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6117] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6119] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6117] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6119] <... futex resumed>) = 0 [pid 6119] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6117] exit_group(0 [pid 6119] <... futex resumed>) = ? [pid 6118] <... futex resumed>) = ? [pid 6117] <... exit_group resumed>) = ? [pid 6119] +++ exited with 0 +++ [pid 6118] +++ exited with 0 +++ [pid 6117] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6117, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./357", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./357", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./357/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./357/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./357/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./357/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./357/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./357/bus") = 0 umount2("./357/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./357/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./357/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./357") = 0 mkdir("./358", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6120 attached , child_tidptr=0x5555564f6750) = 6120 [pid 6120] set_robust_list(0x5555564f6760, 24) = 0 [pid 6120] chdir("./358") = 0 [pid 6120] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6120] setpgid(0, 0) = 0 [pid 6120] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6120] write(3, "1000", 4) = 4 [pid 6120] close(3) = 0 [pid 6120] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6120] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6120] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6120] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6120] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6120] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6120] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6120] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6121 attached [pid 6121] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6120] <... clone3 resumed> => {parent_tid=[6121]}, 88) = 6121 [pid 6121] <... rseq resumed>) = 0 [pid 6120] rt_sigprocmask(SIG_SETMASK, [], [pid 6121] set_robust_list(0x7f6d468e79a0, 24 [pid 6120] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6121] <... set_robust_list resumed>) = 0 [pid 6120] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6121] rt_sigprocmask(SIG_SETMASK, [], [pid 6120] <... futex resumed>) = 0 [pid 6121] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6120] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6121] memfd_create("syzkaller", 0) = 3 [pid 6121] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6121] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6121] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6121] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6121] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6121] close(3) = 0 [pid 6121] mkdir("./bus", 0777) = 0 [pid 6121] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6121] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6121] chdir("./bus") = 0 [pid 6121] ioctl(4, LOOP_CLR_FD) = 0 [pid 6121] close(4) = 0 [pid 6121] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6120] <... futex resumed>) = 0 [pid 6121] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6120] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6121] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6120] <... futex resumed>) = 0 [pid 6121] memfd_create("syzkaller", 0 [pid 6120] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6121] <... memfd_create resumed>) = 4 [pid 6121] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6121] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6121] munmap(0x7f6d360cf000, 32768) = 0 [pid 6121] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6121] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6121] ioctl(5, LOOP_CLR_FD) = 0 [pid 6121] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6121] close(5) = 0 [pid 6121] close(4) = 0 [pid 6121] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6120] <... futex resumed>) = 0 [pid 6120] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6120] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6121] <... futex resumed>) = 1 [pid 6121] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6121] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6120] <... futex resumed>) = 0 [pid 6120] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6120] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6121] <... futex resumed>) = 1 [pid 6121] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6121] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6120] <... futex resumed>) = 0 [pid 6120] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6120] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6121] <... futex resumed>) = 1 [pid 6121] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6121] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6121] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6120] <... futex resumed>) = 0 [pid 6120] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6121] <... futex resumed>) = 0 [pid 6121] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6121] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6120] <... futex resumed>) = 1 [pid 6120] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6121] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6120] <... futex resumed>) = 0 [pid 6120] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6120] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6120] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6121] <... futex resumed>) = 1 [pid 6121] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6121] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [pid 6120] <... mmap resumed>) = 0x7f6d360b6000 [pid 6120] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6120] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6121] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6120] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6121] <... futex resumed>) = 0 [pid 6121] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6120] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6122 attached [pid 6122] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6120] <... clone3 resumed> => {parent_tid=[6122]}, 88) = 6122 [pid 6120] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6120] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6122] <... rseq resumed>) = 0 [pid 6120] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6122] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6122] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6122] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6122] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6122] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6120] <... futex resumed>) = 0 [pid 6120] exit_group(0 [pid 6122] <... futex resumed>) = ? [pid 6121] <... futex resumed>) = ? [pid 6120] <... exit_group resumed>) = ? [pid 6122] +++ exited with 0 +++ [pid 6121] +++ exited with 0 +++ [pid 6120] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6120, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./358", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./358", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 [ 126.849381][ T6121] loop0: detected capacity change from 0 to 64 umount2("./358/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./358/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./358/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./358/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./358/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./358/bus") = 0 umount2("./358/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./358/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./358/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./358") = 0 mkdir("./359", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6123 attached , child_tidptr=0x5555564f6750) = 6123 [pid 6123] set_robust_list(0x5555564f6760, 24) = 0 [pid 6123] chdir("./359") = 0 [pid 6123] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6123] setpgid(0, 0) = 0 [pid 6123] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6123] write(3, "1000", 4) = 4 [pid 6123] close(3) = 0 [pid 6123] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6123] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6123] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6123] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6123] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6123] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6123] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6123] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6124 attached [pid 6124] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6123] <... clone3 resumed> => {parent_tid=[6124]}, 88) = 6124 [pid 6124] <... rseq resumed>) = 0 [pid 6123] rt_sigprocmask(SIG_SETMASK, [], [pid 6124] set_robust_list(0x7f6d468e79a0, 24 [pid 6123] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6124] <... set_robust_list resumed>) = 0 [pid 6123] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6124] rt_sigprocmask(SIG_SETMASK, [], [pid 6123] <... futex resumed>) = 0 [pid 6124] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6123] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6124] memfd_create("syzkaller", 0) = 3 [pid 6124] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6124] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6124] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6124] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6124] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6124] close(3) = 0 [pid 6124] mkdir("./bus", 0777) = 0 [pid 6124] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6124] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6124] chdir("./bus") = 0 [pid 6124] ioctl(4, LOOP_CLR_FD) = 0 [pid 6124] close(4) = 0 [pid 6124] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6124] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6123] <... futex resumed>) = 0 [pid 6123] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6124] <... futex resumed>) = 0 [pid 6123] <... futex resumed>) = 1 [pid 6124] memfd_create("syzkaller", 0 [pid 6123] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6124] <... memfd_create resumed>) = 4 [pid 6124] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6124] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6124] munmap(0x7f6d360cf000, 32768) = 0 [pid 6124] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6124] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6124] ioctl(5, LOOP_CLR_FD) = 0 [pid 6124] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6124] close(5) = 0 [pid 6124] close(4) = 0 [pid 6124] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6124] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6123] <... futex resumed>) = 0 [pid 6123] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6124] <... futex resumed>) = 0 [pid 6123] <... futex resumed>) = 1 [pid 6124] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6123] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6124] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6123] <... futex resumed>) = 0 [pid 6124] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6123] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6124] <... write resumed>) = 12288 [pid 6123] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6124] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6123] <... futex resumed>) = 0 [pid 6123] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6123] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6124] <... futex resumed>) = 1 [ 126.963491][ T6124] loop0: detected capacity change from 0 to 64 [pid 6124] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6124] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6123] <... futex resumed>) = 0 [pid 6123] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6123] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6124] <... futex resumed>) = 1 [pid 6124] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6124] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6124] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6123] <... futex resumed>) = 0 [pid 6123] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6123] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6123] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6123] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6124] <... futex resumed>) = 1 [pid 6124] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6124] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6123] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6124] <... openat resumed>) = 6 [pid 6123] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6125 attached [pid 6125] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6123] <... clone3 resumed> => {parent_tid=[6125]}, 88) = 6125 [pid 6125] <... rseq resumed>) = 0 [pid 6123] rt_sigprocmask(SIG_SETMASK, [], [pid 6125] set_robust_list(0x7f6d360d69a0, 24 [pid 6123] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6125] <... set_robust_list resumed>) = 0 [pid 6124] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6123] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6125] rt_sigprocmask(SIG_SETMASK, [], [pid 6123] <... futex resumed>) = 0 [pid 6125] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6123] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6125] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6124] <... futex resumed>) = 0 [pid 6125] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6124] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6125] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6123] <... futex resumed>) = 0 [pid 6125] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6123] exit_group(0 [pid 6124] <... futex resumed>) = ? [pid 6125] <... futex resumed>) = ? [pid 6123] <... exit_group resumed>) = ? [pid 6124] +++ exited with 0 +++ [pid 6125] +++ exited with 0 +++ [pid 6123] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6123, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./359", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./359", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./359/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./359/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./359/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./359/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./359/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./359/bus") = 0 umount2("./359/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./359/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./359/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./359") = 0 mkdir("./360", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6126 attached , child_tidptr=0x5555564f6750) = 6126 [pid 6126] set_robust_list(0x5555564f6760, 24) = 0 [pid 6126] chdir("./360") = 0 [pid 6126] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6126] setpgid(0, 0) = 0 [pid 6126] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6126] write(3, "1000", 4) = 4 [pid 6126] close(3) = 0 [pid 6126] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6126] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6126] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6126] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6126] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6126] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6126] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6126] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6127 attached => {parent_tid=[6127]}, 88) = 6127 [pid 6126] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6127] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6126] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6127] <... rseq resumed>) = 0 [pid 6127] set_robust_list(0x7f6d468e79a0, 24 [pid 6126] <... futex resumed>) = 0 [pid 6127] <... set_robust_list resumed>) = 0 [pid 6127] rt_sigprocmask(SIG_SETMASK, [], [pid 6126] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6127] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6127] memfd_create("syzkaller", 0) = 3 [pid 6127] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6127] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6127] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6127] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6127] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6127] close(3) = 0 [pid 6127] mkdir("./bus", 0777) = 0 [pid 6127] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6127] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6127] chdir("./bus") = 0 [pid 6127] ioctl(4, LOOP_CLR_FD) = 0 [pid 6127] close(4) = 0 [pid 6127] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6127] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6126] <... futex resumed>) = 0 [pid 6127] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6126] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6127] memfd_create("syzkaller", 0 [pid 6126] <... futex resumed>) = 0 [pid 6127] <... memfd_create resumed>) = 4 [pid 6126] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6127] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6127] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6127] munmap(0x7f6d360cf000, 32768) = 0 [pid 6127] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6127] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6127] ioctl(5, LOOP_CLR_FD) = 0 [pid 6127] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6127] close(5) = 0 [pid 6127] close(4) = 0 [pid 6127] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6126] <... futex resumed>) = 0 [pid 6127] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6126] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6127] <... openat resumed>) = 4 [pid 6126] <... futex resumed>) = 0 [pid 6126] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6127] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6126] <... futex resumed>) = 0 [pid 6126] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6127] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6126] <... futex resumed>) = 0 [pid 6127] <... write resumed>) = 12288 [pid 6126] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6127] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6126] <... futex resumed>) = 0 [pid 6126] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6126] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6127] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6127] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6126] <... futex resumed>) = 0 [pid 6126] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6126] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6127] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [ 127.118125][ T6127] loop0: detected capacity change from 0 to 64 [pid 6127] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6127] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6126] <... futex resumed>) = 0 [pid 6127] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6126] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6127] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6126] <... futex resumed>) = 0 [pid 6127] <... openat resumed>) = 6 [pid 6126] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6126] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6127] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6127] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6126] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6126] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6126] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6128 attached => {parent_tid=[6128]}, 88) = 6128 [pid 6126] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6126] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6126] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6128] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6128] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6128] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6128] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6128] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6128] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6126] <... futex resumed>) = 0 [pid 6126] exit_group(0) = ? [pid 6128] <... futex resumed>) = ? [pid 6127] <... futex resumed>) = ? [pid 6128] +++ exited with 0 +++ [pid 6127] +++ exited with 0 +++ [pid 6126] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6126, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./360", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./360", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./360/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./360/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./360/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./360/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./360/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./360/bus") = 0 umount2("./360/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./360/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./360/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./360") = 0 mkdir("./361", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6129 ./strace-static-x86_64: Process 6129 attached [pid 6129] set_robust_list(0x5555564f6760, 24) = 0 [pid 6129] chdir("./361") = 0 [pid 6129] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6129] setpgid(0, 0) = 0 [pid 6129] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6129] write(3, "1000", 4) = 4 [pid 6129] close(3) = 0 [pid 6129] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6129] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6129] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6129] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6129] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6129] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6129] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6129] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6130 attached => {parent_tid=[6130]}, 88) = 6130 [pid 6130] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6129] rt_sigprocmask(SIG_SETMASK, [], [pid 6130] <... rseq resumed>) = 0 [pid 6129] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6130] set_robust_list(0x7f6d468e79a0, 24 [pid 6129] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6129] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6130] <... set_robust_list resumed>) = 0 [pid 6130] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6130] memfd_create("syzkaller", 0) = 3 [pid 6130] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6130] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6130] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6130] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6130] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6130] close(3) = 0 [pid 6130] mkdir("./bus", 0777) = 0 [pid 6130] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6130] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6130] chdir("./bus") = 0 [pid 6130] ioctl(4, LOOP_CLR_FD) = 0 [pid 6130] close(4) = 0 [pid 6130] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6129] <... futex resumed>) = 0 [pid 6129] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6130] memfd_create("syzkaller", 0 [pid 6129] <... futex resumed>) = 0 [pid 6130] <... memfd_create resumed>) = 4 [pid 6129] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6130] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6130] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6130] munmap(0x7f6d360cf000, 32768) = 0 [pid 6130] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6130] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6130] ioctl(5, LOOP_CLR_FD) = 0 [pid 6130] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6130] close(5) = 0 [pid 6130] close(4) = 0 [pid 6130] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6129] <... futex resumed>) = 0 [pid 6130] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6129] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6130] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6129] <... futex resumed>) = 0 [pid 6130] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6129] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6130] <... openat resumed>) = 4 [pid 6130] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6129] <... futex resumed>) = 0 [pid 6130] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6129] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6129] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6130] <... write resumed>) = 12288 [pid 6130] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6129] <... futex resumed>) = 0 [pid 6130] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6129] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6130] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6129] <... futex resumed>) = 0 [pid 6130] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6129] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6130] <... mmap resumed>) = 0x20000000 [pid 6130] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6129] <... futex resumed>) = 0 [pid 6130] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6129] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6130] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6129] <... futex resumed>) = 0 [pid 6130] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6129] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6130] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6130] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6129] <... futex resumed>) = 0 [pid 6130] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6129] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6130] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6129] <... futex resumed>) = 0 [pid 6130] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6129] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6130] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6129] <... futex resumed>) = 0 [pid 6130] <... openat resumed>) = 6 [pid 6129] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6130] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6130] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6129] <... mmap resumed>) = 0x7f6d360b6000 [pid 6129] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6129] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6129] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6131 attached => {parent_tid=[6131]}, 88) = 6131 [pid 6129] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6129] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 127.268367][ T6130] loop0: detected capacity change from 0 to 64 [pid 6129] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6131] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6131] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6131] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6131] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6131] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6129] <... futex resumed>) = 0 [pid 6131] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6129] exit_group(0 [pid 6131] <... futex resumed>) = ? [pid 6130] <... futex resumed>) = ? [pid 6129] <... exit_group resumed>) = ? [pid 6131] +++ exited with 0 +++ [pid 6130] +++ exited with 0 +++ [pid 6129] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6129, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./361", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./361", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./361/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./361/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./361/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./361/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./361/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./361/bus") = 0 umount2("./361/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./361/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./361/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./361") = 0 mkdir("./362", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6132 attached , child_tidptr=0x5555564f6750) = 6132 [pid 6132] set_robust_list(0x5555564f6760, 24) = 0 [pid 6132] chdir("./362") = 0 [pid 6132] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6132] setpgid(0, 0) = 0 [pid 6132] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6132] write(3, "1000", 4) = 4 [pid 6132] close(3) = 0 [pid 6132] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6132] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6132] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6132] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6132] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6132] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6132] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6132] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6133 attached [pid 6133] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6132] <... clone3 resumed> => {parent_tid=[6133]}, 88) = 6133 [pid 6133] set_robust_list(0x7f6d468e79a0, 24 [pid 6132] rt_sigprocmask(SIG_SETMASK, [], [pid 6133] <... set_robust_list resumed>) = 0 [pid 6132] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6133] rt_sigprocmask(SIG_SETMASK, [], [pid 6132] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6133] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6132] <... futex resumed>) = 0 [pid 6133] memfd_create("syzkaller", 0 [pid 6132] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6133] <... memfd_create resumed>) = 3 [pid 6133] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6133] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6133] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6133] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6133] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6133] close(3) = 0 [pid 6133] mkdir("./bus", 0777) = 0 [pid 6133] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6133] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6133] chdir("./bus") = 0 [pid 6133] ioctl(4, LOOP_CLR_FD) = 0 [pid 6133] close(4) = 0 [pid 6133] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6133] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6132] <... futex resumed>) = 0 [pid 6132] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6133] <... futex resumed>) = 0 [pid 6133] memfd_create("syzkaller", 0 [pid 6132] <... futex resumed>) = 1 [pid 6133] <... memfd_create resumed>) = 4 [pid 6132] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6133] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6133] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6133] munmap(0x7f6d360cf000, 32768) = 0 [pid 6133] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6133] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6133] ioctl(5, LOOP_CLR_FD) = 0 [pid 6133] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6133] close(5) = 0 [pid 6133] close(4) = 0 [pid 6133] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6132] <... futex resumed>) = 0 [pid 6133] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6132] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6133] <... openat resumed>) = 4 [pid 6132] <... futex resumed>) = 0 [pid 6132] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6133] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6132] <... futex resumed>) = 0 [pid 6133] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6132] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6133] <... futex resumed>) = 0 [pid 6133] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6132] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6133] <... write resumed>) = 12288 [pid 6133] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6132] <... futex resumed>) = 0 [pid 6133] <... futex resumed>) = 1 [pid 6132] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6133] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6132] <... futex resumed>) = 0 [pid 6132] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6133] <... mmap resumed>) = 0x20000000 [pid 6133] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6133] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6132] <... futex resumed>) = 0 [pid 6132] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6133] <... futex resumed>) = 0 [pid 6133] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6132] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6133] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6133] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6132] <... futex resumed>) = 0 [pid 6133] <... futex resumed>) = 1 [pid 6132] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6133] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6132] <... futex resumed>) = 0 [pid 6132] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6133] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [pid 6132] <... futex resumed>) = 0 [pid 6132] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6133] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6132] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6133] <... futex resumed>) = 0 [pid 6132] <... mprotect resumed>) = 0 [pid 6133] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6132] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6132] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} => {parent_tid=[6134]}, 88) = 6134 ./strace-static-x86_64: Process 6134 attached [ 127.406789][ T6133] loop0: detected capacity change from 0 to 64 [pid 6134] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6132] rt_sigprocmask(SIG_SETMASK, [], [pid 6134] <... rseq resumed>) = 0 [pid 6132] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6134] set_robust_list(0x7f6d360d69a0, 24 [pid 6132] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6134] <... set_robust_list resumed>) = 0 [pid 6132] <... futex resumed>) = 0 [pid 6132] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6134] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6134] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6134] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6132] <... futex resumed>) = 0 [pid 6134] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6132] exit_group(0 [pid 6134] <... futex resumed>) = ? [pid 6133] <... futex resumed>) = ? [pid 6132] <... exit_group resumed>) = ? [pid 6134] +++ exited with 0 +++ [pid 6133] +++ exited with 0 +++ [pid 6132] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6132, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./362", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./362", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./362/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./362/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./362/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./362/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./362/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./362/bus") = 0 umount2("./362/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./362/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./362/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./362") = 0 mkdir("./363", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6135 attached , child_tidptr=0x5555564f6750) = 6135 [pid 6135] set_robust_list(0x5555564f6760, 24) = 0 [pid 6135] chdir("./363") = 0 [pid 6135] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6135] setpgid(0, 0) = 0 [pid 6135] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6135] write(3, "1000", 4) = 4 [pid 6135] close(3) = 0 [pid 6135] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6135] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6135] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6135] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6135] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6135] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6135] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6135] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6136 attached => {parent_tid=[6136]}, 88) = 6136 [pid 6136] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6136] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6136] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6135] rt_sigprocmask(SIG_SETMASK, [], [pid 6136] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6135] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6135] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6136] <... futex resumed>) = 0 [pid 6135] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6136] memfd_create("syzkaller", 0) = 3 [pid 6136] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6136] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6136] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6136] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6136] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6136] close(3) = 0 [pid 6136] mkdir("./bus", 0777) = 0 [pid 6136] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6136] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6136] chdir("./bus") = 0 [pid 6136] ioctl(4, LOOP_CLR_FD) = 0 [pid 6136] close(4) = 0 [pid 6136] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6135] <... futex resumed>) = 0 [pid 6136] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6135] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6136] <... futex resumed>) = 0 [pid 6135] <... futex resumed>) = 1 [pid 6136] memfd_create("syzkaller", 0 [pid 6135] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6136] <... memfd_create resumed>) = 4 [pid 6136] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6136] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6136] munmap(0x7f6d360cf000, 32768) = 0 [pid 6136] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6136] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6136] ioctl(5, LOOP_CLR_FD) = 0 [pid 6136] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6136] close(5) = 0 [pid 6136] close(4) = 0 [pid 6136] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6136] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6135] <... futex resumed>) = 0 [pid 6135] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6136] <... futex resumed>) = 0 [pid 6135] <... futex resumed>) = 1 [pid 6136] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6135] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6136] <... openat resumed>) = 4 [pid 6136] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6135] <... futex resumed>) = 0 [pid 6136] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6135] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6136] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6135] <... futex resumed>) = 0 [pid 6136] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6135] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6136] <... write resumed>) = 12288 [pid 6136] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6135] <... futex resumed>) = 0 [pid 6136] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 6135] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6136] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6135] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6136] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6135] <... futex resumed>) = 0 [pid 6135] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6136] <... futex resumed>) = 1 [pid 6136] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6135] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6136] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6136] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6135] <... futex resumed>) = 0 [pid 6136] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6135] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6136] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6135] <... futex resumed>) = 0 [pid 6136] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6135] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6136] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6135] <... futex resumed>) = 0 [ 127.546701][ T6136] loop0: detected capacity change from 0 to 64 [pid 6135] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6136] <... openat resumed>) = 6 [pid 6136] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6135] <... mmap resumed>) = 0x7f6d360b6000 [pid 6135] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6136] <... futex resumed>) = 0 [pid 6136] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6135] <... mprotect resumed>) = 0 [pid 6135] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6135] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6137 attached [pid 6137] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6135] <... clone3 resumed> => {parent_tid=[6137]}, 88) = 6137 [pid 6135] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6135] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6135] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6137] <... rseq resumed>) = 0 [pid 6137] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6137] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6137] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6137] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6135] <... futex resumed>) = 0 [pid 6137] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6135] exit_group(0 [pid 6136] <... futex resumed>) = ? [pid 6137] <... futex resumed>) = ? [pid 6136] +++ exited with 0 +++ [pid 6135] <... exit_group resumed>) = ? [pid 6137] +++ exited with 0 +++ [pid 6135] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6135, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./363", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./363", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./363/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./363/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./363/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./363/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./363/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./363/bus") = 0 umount2("./363/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./363/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./363/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./363") = 0 mkdir("./364", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6138 attached , child_tidptr=0x5555564f6750) = 6138 [pid 6138] set_robust_list(0x5555564f6760, 24) = 0 [pid 6138] chdir("./364") = 0 [pid 6138] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6138] setpgid(0, 0) = 0 [pid 6138] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6138] write(3, "1000", 4) = 4 [pid 6138] close(3) = 0 [pid 6138] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6138] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6138] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6138] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6138] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6138] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6138] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6138] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6139 attached [pid 6139] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6138] <... clone3 resumed> => {parent_tid=[6139]}, 88) = 6139 [pid 6138] rt_sigprocmask(SIG_SETMASK, [], [pid 6139] <... rseq resumed>) = 0 [pid 6138] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6138] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6138] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6139] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6139] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6139] memfd_create("syzkaller", 0) = 3 [pid 6139] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6139] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6139] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6139] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6139] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6139] close(3) = 0 [pid 6139] mkdir("./bus", 0777) = 0 [pid 6139] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6139] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6139] chdir("./bus") = 0 [pid 6139] ioctl(4, LOOP_CLR_FD) = 0 [pid 6139] close(4) = 0 [pid 6139] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6138] <... futex resumed>) = 0 [pid 6139] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6138] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6139] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6138] <... futex resumed>) = 0 [pid 6139] memfd_create("syzkaller", 0) = 4 [pid 6138] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6139] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6139] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6139] munmap(0x7f6d360cf000, 32768) = 0 [pid 6139] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6139] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6139] ioctl(5, LOOP_CLR_FD) = 0 [pid 6139] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6139] close(5) = 0 [pid 6139] close(4) = 0 [pid 6139] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6138] <... futex resumed>) = 0 [pid 6139] <... futex resumed>) = 1 [pid 6138] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6139] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6138] <... futex resumed>) = 0 [pid 6139] <... openat resumed>) = 4 [pid 6138] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6139] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6138] <... futex resumed>) = 0 [pid 6138] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6138] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6139] <... futex resumed>) = 1 [pid 6139] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6139] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6138] <... futex resumed>) = 0 [pid 6139] <... futex resumed>) = 1 [pid 6138] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6139] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6138] <... futex resumed>) = 0 [pid 6139] <... mmap resumed>) = 0x20000000 [pid 6138] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6139] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6138] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6139] <... futex resumed>) = 0 [pid 6138] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6139] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6138] <... futex resumed>) = 0 [pid 6139] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6138] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6139] <... openat resumed>) = 5 [pid 6139] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6138] <... futex resumed>) = 0 [pid 6139] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 6138] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6139] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6138] <... futex resumed>) = 0 [pid 6139] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6138] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6139] <... openat resumed>) = 6 [pid 6138] <... futex resumed>) = 0 [pid 6139] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6138] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6139] <... futex resumed>) = 0 [pid 6139] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6138] <... mmap resumed>) = 0x7f6d360b6000 [pid 6138] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6138] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6138] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} => {parent_tid=[6140]}, 88) = 6140 ./strace-static-x86_64: Process 6140 attached [pid 6140] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6138] rt_sigprocmask(SIG_SETMASK, [], [pid 6140] <... rseq resumed>) = 0 [pid 6140] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6138] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6140] rt_sigprocmask(SIG_SETMASK, [], [pid 6138] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6140] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6138] <... futex resumed>) = 0 [pid 6140] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6138] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6140] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6140] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6138] <... futex resumed>) = 0 [pid 6140] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6138] exit_group(0 [pid 6140] <... futex resumed>) = ? [pid 6139] <... futex resumed>) = ? [pid 6138] <... exit_group resumed>) = ? [pid 6139] +++ exited with 0 +++ [pid 6140] +++ exited with 0 +++ [pid 6138] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6138, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./364", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./364", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./364/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./364/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./364/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./364/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./364/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 [ 127.676447][ T6139] loop0: detected capacity change from 0 to 64 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./364/bus") = 0 umount2("./364/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./364/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./364/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./364") = 0 mkdir("./365", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6141 ./strace-static-x86_64: Process 6141 attached [pid 6141] set_robust_list(0x5555564f6760, 24) = 0 [pid 6141] chdir("./365") = 0 [pid 6141] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6141] setpgid(0, 0) = 0 [pid 6141] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6141] write(3, "1000", 4) = 4 [pid 6141] close(3) = 0 [pid 6141] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6141] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6141] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6141] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6141] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6141] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6141] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6141] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6142 attached => {parent_tid=[6142]}, 88) = 6142 [pid 6142] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6141] rt_sigprocmask(SIG_SETMASK, [], [pid 6142] <... rseq resumed>) = 0 [pid 6141] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6142] set_robust_list(0x7f6d468e79a0, 24 [pid 6141] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6142] <... set_robust_list resumed>) = 0 [pid 6141] <... futex resumed>) = 0 [pid 6142] rt_sigprocmask(SIG_SETMASK, [], [pid 6141] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6142] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6142] memfd_create("syzkaller", 0) = 3 [pid 6142] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6142] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6142] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6142] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6142] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6142] close(3) = 0 [pid 6142] mkdir("./bus", 0777) = 0 [pid 6142] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6142] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6142] chdir("./bus") = 0 [pid 6142] ioctl(4, LOOP_CLR_FD) = 0 [pid 6142] close(4) = 0 [pid 6142] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6141] <... futex resumed>) = 0 [pid 6142] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6141] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6142] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6141] <... futex resumed>) = 0 [pid 6142] memfd_create("syzkaller", 0 [pid 6141] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6142] <... memfd_create resumed>) = 4 [pid 6142] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6142] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6142] munmap(0x7f6d360cf000, 32768) = 0 [pid 6142] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6142] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6142] ioctl(5, LOOP_CLR_FD) = 0 [pid 6142] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6142] close(5) = 0 [pid 6142] close(4) = 0 [pid 6142] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6141] <... futex resumed>) = 0 [pid 6141] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6141] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6142] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6142] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6141] <... futex resumed>) = 0 [pid 6141] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6141] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6142] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6142] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6141] <... futex resumed>) = 0 [pid 6141] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6142] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6141] <... futex resumed>) = 0 [pid 6141] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6142] <... mmap resumed>) = 0x20000000 [pid 6142] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6141] <... futex resumed>) = 0 [pid 6141] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6142] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6141] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6142] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6142] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6141] <... futex resumed>) = 0 [ 127.774948][ T6142] loop0: detected capacity change from 0 to 64 [pid 6141] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6142] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6141] <... futex resumed>) = 0 [pid 6142] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [pid 6141] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6141] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6142] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6141] <... mmap resumed>) = 0x7f6d360b6000 [pid 6141] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6142] <... futex resumed>) = 0 [pid 6141] <... mprotect resumed>) = 0 [pid 6142] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6141] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6141] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6143 attached [pid 6143] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6143] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6143] rt_sigprocmask(SIG_SETMASK, [], [pid 6141] <... clone3 resumed> => {parent_tid=[6143]}, 88) = 6143 [pid 6141] rt_sigprocmask(SIG_SETMASK, [], [pid 6143] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6141] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6143] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6141] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6143] <... futex resumed>) = 0 [pid 6141] <... futex resumed>) = 1 [pid 6141] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6143] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6143] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6143] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6141] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6141] exit_group(0 [pid 6143] <... futex resumed>) = ? [pid 6142] <... futex resumed>) = ? [pid 6141] <... exit_group resumed>) = ? [pid 6143] +++ exited with 0 +++ [pid 6142] +++ exited with 0 +++ [pid 6141] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6141, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./365", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./365", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./365/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./365/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./365/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./365/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./365/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./365/bus") = 0 umount2("./365/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./365/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./365/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./365") = 0 mkdir("./366", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6144 attached [pid 6144] set_robust_list(0x5555564f6760, 24) = 0 [pid 5037] <... clone resumed>, child_tidptr=0x5555564f6750) = 6144 [pid 6144] chdir("./366") = 0 [pid 6144] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6144] setpgid(0, 0) = 0 [pid 6144] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6144] write(3, "1000", 4) = 4 [pid 6144] close(3) = 0 [pid 6144] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6144] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6144] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6144] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6144] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6144] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6144] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6144] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6145 attached [pid 6145] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6144] <... clone3 resumed> => {parent_tid=[6145]}, 88) = 6145 [pid 6145] <... rseq resumed>) = 0 [pid 6144] rt_sigprocmask(SIG_SETMASK, [], [pid 6145] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6144] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6145] rt_sigprocmask(SIG_SETMASK, [], [pid 6144] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6145] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6144] <... futex resumed>) = 0 [pid 6144] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6145] memfd_create("syzkaller", 0) = 3 [pid 6145] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6145] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6145] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6145] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6145] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6145] close(3) = 0 [pid 6145] mkdir("./bus", 0777) = 0 [pid 6145] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6145] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6145] chdir("./bus") = 0 [pid 6145] ioctl(4, LOOP_CLR_FD) = 0 [pid 6145] close(4) = 0 [pid 6145] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6144] <... futex resumed>) = 0 [pid 6145] <... futex resumed>) = 1 [pid 6145] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6144] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6145] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6144] <... futex resumed>) = 0 [pid 6145] memfd_create("syzkaller", 0 [pid 6144] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6145] <... memfd_create resumed>) = 4 [pid 6145] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6145] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6145] munmap(0x7f6d360cf000, 32768) = 0 [pid 6145] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6145] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6145] ioctl(5, LOOP_CLR_FD) = 0 [pid 6145] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6145] close(5) = 0 [pid 6145] close(4) = 0 [pid 6145] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6144] <... futex resumed>) = 0 [pid 6145] <... futex resumed>) = 1 [pid 6145] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6144] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6145] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6144] <... futex resumed>) = 0 [pid 6145] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6144] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6145] <... openat resumed>) = 4 [pid 6145] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6144] <... futex resumed>) = 0 [pid 6144] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6144] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6145] <... futex resumed>) = 1 [pid 6145] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6145] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6144] <... futex resumed>) = 0 [pid 6145] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6144] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6145] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6144] <... futex resumed>) = 0 [pid 6145] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6144] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6145] <... mmap resumed>) = 0x20000000 [pid 6145] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6144] <... futex resumed>) = 0 [pid 6144] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6144] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6145] <... futex resumed>) = 1 [pid 6145] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6145] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6145] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6144] <... futex resumed>) = 0 [pid 6145] <... futex resumed>) = 1 [pid 6144] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6145] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6144] <... futex resumed>) = 0 [pid 6145] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6144] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6145] <... openat resumed>) = 6 [pid 6144] <... futex resumed>) = 0 [pid 6144] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6144] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6145] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6145] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6144] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6144] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6146 attached [pid 6146] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6144] <... clone3 resumed> => {parent_tid=[6146]}, 88) = 6146 [pid 6146] set_robust_list(0x7f6d360d69a0, 24 [pid 6144] rt_sigprocmask(SIG_SETMASK, [], [pid 6146] <... set_robust_list resumed>) = 0 [pid 6144] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6146] rt_sigprocmask(SIG_SETMASK, [], [pid 6144] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6146] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6146] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6144] <... futex resumed>) = 0 [pid 6146] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6144] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6146] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6144] <... futex resumed>) = 0 [pid 6144] exit_group(0 [pid 6145] <... futex resumed>) = ? [pid 6145] +++ exited with 0 +++ [pid 6144] <... exit_group resumed>) = ? [pid 6146] <... futex resumed>) = ? [pid 6146] +++ exited with 0 +++ [pid 6144] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6144, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./366", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./366", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./366/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [ 127.905241][ T6145] loop0: detected capacity change from 0 to 64 umount2("./366/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./366/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./366/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./366/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./366/bus") = 0 umount2("./366/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./366/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./366/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./366") = 0 mkdir("./367", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6147 attached , child_tidptr=0x5555564f6750) = 6147 [pid 6147] set_robust_list(0x5555564f6760, 24) = 0 [pid 6147] chdir("./367") = 0 [pid 6147] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6147] setpgid(0, 0) = 0 [pid 6147] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6147] write(3, "1000", 4) = 4 [pid 6147] close(3) = 0 [pid 6147] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6147] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6147] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6147] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6147] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6147] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6147] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6147] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6148 attached [pid 6148] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6148] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6147] <... clone3 resumed> => {parent_tid=[6148]}, 88) = 6148 [pid 6147] rt_sigprocmask(SIG_SETMASK, [], [pid 6148] rt_sigprocmask(SIG_SETMASK, [], [pid 6147] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6147] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6147] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6148] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6148] memfd_create("syzkaller", 0) = 3 [pid 6148] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6148] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6148] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6148] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6148] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6148] close(3) = 0 [pid 6148] mkdir("./bus", 0777) = 0 [pid 6148] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6148] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6148] chdir("./bus") = 0 [pid 6148] ioctl(4, LOOP_CLR_FD) = 0 [pid 6148] close(4) = 0 [pid 6148] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6147] <... futex resumed>) = 0 [pid 6148] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6147] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6148] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6147] <... futex resumed>) = 0 [pid 6148] memfd_create("syzkaller", 0 [pid 6147] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6148] <... memfd_create resumed>) = 4 [pid 6148] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6148] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6148] munmap(0x7f6d360cf000, 32768) = 0 [pid 6148] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6148] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6148] ioctl(5, LOOP_CLR_FD) = 0 [pid 6148] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6148] close(5) = 0 [pid 6148] close(4) = 0 [pid 6148] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6147] <... futex resumed>) = 0 [pid 6148] <... futex resumed>) = 1 [pid 6148] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6147] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6148] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6147] <... futex resumed>) = 0 [pid 6148] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6147] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6148] <... openat resumed>) = 4 [pid 6148] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6147] <... futex resumed>) = 0 [pid 6147] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6147] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6148] <... futex resumed>) = 1 [pid 6148] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6148] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6147] <... futex resumed>) = 0 [pid 6147] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6147] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6148] <... futex resumed>) = 1 [pid 6148] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6148] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6147] <... futex resumed>) = 0 [pid 6147] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 128.022882][ T6148] loop0: detected capacity change from 0 to 64 [pid 6147] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6148] <... futex resumed>) = 1 [pid 6148] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6148] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6148] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6147] <... futex resumed>) = 0 [pid 6147] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6148] <... futex resumed>) = 1 [pid 6147] <... futex resumed>) = 0 [pid 6148] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6147] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6148] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6147] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6147] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6148] <... openat resumed>) = 6 [pid 6147] <... mprotect resumed>) = 0 [pid 6148] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6147] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6148] <... futex resumed>) = 0 [pid 6148] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6147] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6147] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6149 attached => {parent_tid=[6149]}, 88) = 6149 [pid 6147] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6147] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6149] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6147] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6149] <... rseq resumed>) = 0 [pid 6149] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6149] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6149] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6149] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6147] <... futex resumed>) = 0 [pid 6149] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6147] exit_group(0 [pid 6149] <... futex resumed>) = ? [pid 6148] <... futex resumed>) = ? [pid 6149] +++ exited with 0 +++ [pid 6147] <... exit_group resumed>) = ? [pid 6148] +++ exited with 0 +++ [pid 6147] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6147, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./367", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./367", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./367/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./367/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./367/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./367/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./367/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./367/bus") = 0 umount2("./367/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./367/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./367/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./367") = 0 mkdir("./368", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6150 attached , child_tidptr=0x5555564f6750) = 6150 [pid 6150] set_robust_list(0x5555564f6760, 24) = 0 [pid 6150] chdir("./368") = 0 [pid 6150] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6150] setpgid(0, 0) = 0 [pid 6150] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6150] write(3, "1000", 4) = 4 [pid 6150] close(3) = 0 [pid 6150] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6150] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6150] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6150] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6150] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6150] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6150] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6150] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6151 attached [pid 6151] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6150] <... clone3 resumed> => {parent_tid=[6151]}, 88) = 6151 [pid 6151] <... rseq resumed>) = 0 [pid 6151] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6151] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6150] rt_sigprocmask(SIG_SETMASK, [], [pid 6151] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6150] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6150] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6151] <... futex resumed>) = 0 [pid 6150] <... futex resumed>) = 1 [pid 6151] memfd_create("syzkaller", 0 [pid 6150] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6151] <... memfd_create resumed>) = 3 [pid 6151] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6151] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6151] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6151] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6151] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6151] close(3) = 0 [pid 6151] mkdir("./bus", 0777) = 0 [pid 6151] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6151] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6151] chdir("./bus") = 0 [pid 6151] ioctl(4, LOOP_CLR_FD) = 0 [pid 6151] close(4) = 0 [pid 6151] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6150] <... futex resumed>) = 0 [pid 6150] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6151] memfd_create("syzkaller", 0 [pid 6150] <... futex resumed>) = 0 [pid 6150] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6151] <... memfd_create resumed>) = 4 [pid 6151] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6151] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6151] munmap(0x7f6d360cf000, 32768) = 0 [pid 6151] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6151] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6151] ioctl(5, LOOP_CLR_FD) = 0 [pid 6151] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6151] close(5) = 0 [pid 6151] close(4) = 0 [pid 6151] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6151] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6150] <... futex resumed>) = 0 [pid 6150] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6151] <... futex resumed>) = 0 [pid 6150] <... futex resumed>) = 1 [pid 6151] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6150] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6151] <... openat resumed>) = 4 [pid 6151] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6150] <... futex resumed>) = 0 [pid 6151] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6150] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6151] <... write resumed>) = 12288 [pid 6150] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6151] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6150] <... futex resumed>) = 0 [ 128.175804][ T6151] loop0: detected capacity change from 0 to 64 [pid 6150] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6151] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6150] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6151] <... mmap resumed>) = 0x20000000 [pid 6151] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6150] <... futex resumed>) = 0 [pid 6151] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6150] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6151] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6150] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6151] <... openat resumed>) = 5 [pid 6151] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6150] <... futex resumed>) = 0 [pid 6150] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6150] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6151] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6150] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6151] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6150] <... mmap resumed>) = 0x7f6d360b6000 [pid 6151] <... openat resumed>) = 6 [pid 6150] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6151] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6150] <... mprotect resumed>) = 0 [pid 6150] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6150] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6151] <... futex resumed>) = 0 ./strace-static-x86_64: Process 6152 attached [pid 6151] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6152] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6150] <... clone3 resumed> => {parent_tid=[6152]}, 88) = 6152 [pid 6152] <... rseq resumed>) = 0 [pid 6150] rt_sigprocmask(SIG_SETMASK, [], [pid 6152] set_robust_list(0x7f6d360d69a0, 24 [pid 6150] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6152] <... set_robust_list resumed>) = 0 [pid 6150] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6152] rt_sigprocmask(SIG_SETMASK, [], [pid 6150] <... futex resumed>) = 0 [pid 6152] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6150] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6152] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6152] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6150] <... futex resumed>) = 0 [pid 6152] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6150] exit_group(0) = ? [pid 6152] <... futex resumed>) = ? [pid 6152] +++ exited with 0 +++ [pid 6151] <... futex resumed>) = ? [pid 6151] +++ exited with 0 +++ [pid 6150] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6150, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./368", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./368", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./368/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./368/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./368/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./368/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./368/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./368/bus") = 0 umount2("./368/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./368/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./368/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./368") = 0 mkdir("./369", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6153 ./strace-static-x86_64: Process 6153 attached [pid 6153] set_robust_list(0x5555564f6760, 24) = 0 [pid 6153] chdir("./369") = 0 [pid 6153] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6153] setpgid(0, 0) = 0 [pid 6153] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6153] write(3, "1000", 4) = 4 [pid 6153] close(3) = 0 [pid 6153] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6153] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6153] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6153] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6153] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6153] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6153] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6153] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6154 attached [pid 6154] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6154] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6154] rt_sigprocmask(SIG_SETMASK, [], [pid 6153] <... clone3 resumed> => {parent_tid=[6154]}, 88) = 6154 [pid 6153] rt_sigprocmask(SIG_SETMASK, [], [pid 6154] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6153] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6154] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6153] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6154] <... futex resumed>) = 0 [pid 6153] <... futex resumed>) = 1 [pid 6154] memfd_create("syzkaller", 0) = 3 [pid 6154] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6153] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6154] <... mmap resumed>) = 0x7f6d3e4c7000 [pid 6154] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6154] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6154] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6154] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6154] close(3) = 0 [pid 6154] mkdir("./bus", 0777) = 0 [pid 6154] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6154] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6154] chdir("./bus") = 0 [pid 6154] ioctl(4, LOOP_CLR_FD) = 0 [pid 6154] close(4) = 0 [pid 6154] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6153] <... futex resumed>) = 0 [pid 6153] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6153] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6154] <... futex resumed>) = 1 [pid 6154] memfd_create("syzkaller", 0) = 4 [pid 6154] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6154] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6154] munmap(0x7f6d360cf000, 32768) = 0 [pid 6154] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6154] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6154] ioctl(5, LOOP_CLR_FD) = 0 [pid 6154] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6154] close(5) = 0 [pid 6154] close(4) = 0 [pid 6154] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6153] <... futex resumed>) = 0 [pid 6154] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6153] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6154] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6153] <... futex resumed>) = 0 [pid 6154] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6153] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6154] <... openat resumed>) = 4 [pid 6154] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6153] <... futex resumed>) = 0 [pid 6154] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6153] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6154] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6153] <... futex resumed>) = 0 [pid 6153] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6154] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6154] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6153] <... futex resumed>) = 0 [pid 6153] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6153] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6154] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6154] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6153] <... futex resumed>) = 0 [pid 6154] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6153] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6154] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6153] <... futex resumed>) = 0 [pid 6153] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6154] <... openat resumed>) = 5 [pid 6154] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6153] <... futex resumed>) = 0 [pid 6154] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6153] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6154] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6153] <... futex resumed>) = 0 [ 128.322564][ T6154] loop0: detected capacity change from 0 to 64 [pid 6154] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6153] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6154] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6153] <... futex resumed>) = 0 [pid 6154] <... openat resumed>) = 6 [pid 6153] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6153] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6153] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6153] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6154] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6153] <... clone3 resumed> => {parent_tid=[6155]}, 88) = 6155 [pid 6154] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6153] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 6155 attached NULL, 8) = 0 [pid 6155] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6153] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6155] <... rseq resumed>) = 0 [pid 6153] <... futex resumed>) = 0 [pid 6155] set_robust_list(0x7f6d360d69a0, 24 [pid 6153] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6155] <... set_robust_list resumed>) = 0 [pid 6155] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6155] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6155] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6153] <... futex resumed>) = 0 [pid 6155] <... futex resumed>) = 1 [pid 6155] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6153] exit_group(0 [pid 6154] <... futex resumed>) = ? [pid 6155] <... futex resumed>) = ? [pid 6153] <... exit_group resumed>) = ? [pid 6155] +++ exited with 0 +++ [pid 6154] +++ exited with 0 +++ [pid 6153] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6153, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./369", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./369", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./369/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./369/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./369/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./369/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./369/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./369/bus") = 0 umount2("./369/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./369/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./369/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./369") = 0 mkdir("./370", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6156 attached , child_tidptr=0x5555564f6750) = 6156 [pid 6156] set_robust_list(0x5555564f6760, 24) = 0 [pid 6156] chdir("./370") = 0 [pid 6156] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6156] setpgid(0, 0) = 0 [pid 6156] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6156] write(3, "1000", 4) = 4 [pid 6156] close(3) = 0 [pid 6156] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6156] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6156] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6156] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6156] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6156] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6156] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6156] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6157 attached => {parent_tid=[6157]}, 88) = 6157 [pid 6156] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6156] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6156] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6157] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6157] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6157] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6157] memfd_create("syzkaller", 0) = 3 [pid 6157] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6157] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6157] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6157] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6157] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6157] close(3) = 0 [pid 6157] mkdir("./bus", 0777) = 0 [pid 6157] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6157] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6157] chdir("./bus") = 0 [pid 6157] ioctl(4, LOOP_CLR_FD) = 0 [pid 6157] close(4) = 0 [pid 6157] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6157] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6156] <... futex resumed>) = 0 [pid 6156] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6157] <... futex resumed>) = 0 [pid 6156] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6157] memfd_create("syzkaller", 0) = 4 [pid 6157] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6157] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6157] munmap(0x7f6d360cf000, 32768) = 0 [pid 6157] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6157] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6157] ioctl(5, LOOP_CLR_FD) = 0 [pid 6157] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6157] close(5) = 0 [pid 6157] close(4) = 0 [pid 6157] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6157] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6156] <... futex resumed>) = 0 [pid 6156] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6157] <... futex resumed>) = 0 [pid 6156] <... futex resumed>) = 1 [pid 6157] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6156] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6157] <... openat resumed>) = 4 [pid 6157] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6157] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6156] <... futex resumed>) = 0 [pid 6156] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6157] <... futex resumed>) = 0 [pid 6156] <... futex resumed>) = 1 [pid 6157] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6156] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6157] <... write resumed>) = 12288 [ 128.446020][ T6157] loop0: detected capacity change from 0 to 64 [pid 6157] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6157] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6156] <... futex resumed>) = 0 [pid 6156] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6157] <... futex resumed>) = 0 [pid 6156] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6157] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6157] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6156] <... futex resumed>) = 0 [pid 6156] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6156] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6157] <... futex resumed>) = 1 [pid 6157] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6157] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6157] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6156] <... futex resumed>) = 0 [pid 6157] <... futex resumed>) = 1 [pid 6156] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6157] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6156] <... futex resumed>) = 0 [pid 6157] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6156] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6157] <... openat resumed>) = 6 [pid 6156] <... futex resumed>) = 0 [pid 6156] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6157] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6157] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6156] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6156] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6156] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6158 attached => {parent_tid=[6158]}, 88) = 6158 [pid 6158] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6156] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6156] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6156] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6158] <... rseq resumed>) = 0 [pid 6158] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6158] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6158] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6158] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6156] <... futex resumed>) = 0 [pid 6158] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6156] exit_group(0 [pid 6158] <... futex resumed>) = ? [pid 6158] +++ exited with 0 +++ [pid 6157] <... futex resumed>) = ? [pid 6156] <... exit_group resumed>) = ? [pid 6157] +++ exited with 0 +++ [pid 6156] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6156, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./370", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./370", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./370/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./370/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./370/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./370/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./370/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./370/bus") = 0 umount2("./370/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./370/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./370/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./370") = 0 mkdir("./371", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6159 ./strace-static-x86_64: Process 6159 attached [pid 6159] set_robust_list(0x5555564f6760, 24) = 0 [pid 6159] chdir("./371") = 0 [pid 6159] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6159] setpgid(0, 0) = 0 [pid 6159] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6159] write(3, "1000", 4) = 4 [pid 6159] close(3) = 0 [pid 6159] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6159] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6159] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6159] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6159] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6159] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6159] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6159] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6160 attached => {parent_tid=[6160]}, 88) = 6160 [pid 6159] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6159] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6159] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6160] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6160] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6160] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6160] memfd_create("syzkaller", 0) = 3 [pid 6160] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6160] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6160] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6160] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6160] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6160] close(3) = 0 [pid 6160] mkdir("./bus", 0777) = 0 [pid 6160] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6160] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6160] chdir("./bus") = 0 [pid 6160] ioctl(4, LOOP_CLR_FD) = 0 [pid 6160] close(4) = 0 [pid 6160] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6160] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6159] <... futex resumed>) = 0 [pid 6159] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6160] <... futex resumed>) = 0 [pid 6160] memfd_create("syzkaller", 0) = 4 [pid 6160] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6160] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768 [pid 6159] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6160] <... write resumed>) = 32768 [pid 6160] munmap(0x7f6d360cf000, 32768) = 0 [pid 6160] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6160] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6160] ioctl(5, LOOP_CLR_FD) = 0 [pid 6160] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6160] close(5) = 0 [pid 6160] close(4) = 0 [pid 6160] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6159] <... futex resumed>) = 0 [pid 6159] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6159] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6160] <... futex resumed>) = 1 [pid 6160] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6160] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6159] <... futex resumed>) = 0 [pid 6159] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6159] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6160] <... futex resumed>) = 1 [pid 6160] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6160] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6159] <... futex resumed>) = 0 [pid 6159] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6159] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6160] <... futex resumed>) = 1 [pid 6160] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [ 128.583906][ T6160] loop0: detected capacity change from 0 to 64 [pid 6160] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6160] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6159] <... futex resumed>) = 0 [pid 6159] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6160] <... futex resumed>) = 0 [pid 6159] <... futex resumed>) = 1 [pid 6160] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6160] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6159] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6160] <... openat resumed>) = 5 [pid 6160] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6159] <... futex resumed>) = 0 [pid 6160] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 6159] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6160] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6160] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6159] <... futex resumed>) = 0 [pid 6159] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6159] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6159] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6160] <... openat resumed>) = 6 [pid 6159] <... mprotect resumed>) = 0 [pid 6159] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6160] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6159] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6160] <... futex resumed>) = 0 [pid 6159] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6160] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 6161 attached [pid 6161] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6161] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6161] rt_sigprocmask(SIG_SETMASK, [], [pid 6159] <... clone3 resumed> => {parent_tid=[6161]}, 88) = 6161 [pid 6161] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6161] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6159] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6159] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6159] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6161] <... futex resumed>) = 0 [pid 6161] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6161] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6159] <... futex resumed>) = 0 [pid 6159] exit_group(0) = ? [pid 6161] <... futex resumed>) = ? [pid 6161] +++ exited with 0 +++ [pid 6160] <... futex resumed>) = ? [pid 6160] +++ exited with 0 +++ [pid 6159] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6159, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./371", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./371", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./371/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./371/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./371/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./371/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./371/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./371/bus") = 0 umount2("./371/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./371/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./371/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./371") = 0 mkdir("./372", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6162 attached , child_tidptr=0x5555564f6750) = 6162 [pid 6162] set_robust_list(0x5555564f6760, 24) = 0 [pid 6162] chdir("./372") = 0 [pid 6162] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6162] setpgid(0, 0) = 0 [pid 6162] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6162] write(3, "1000", 4) = 4 [pid 6162] close(3) = 0 [pid 6162] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6162] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6162] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6162] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6162] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6162] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6162] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6162] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6163 attached => {parent_tid=[6163]}, 88) = 6163 [pid 6162] rt_sigprocmask(SIG_SETMASK, [], [pid 6163] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6162] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6163] <... rseq resumed>) = 0 [pid 6163] set_robust_list(0x7f6d468e79a0, 24 [pid 6162] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6163] <... set_robust_list resumed>) = 0 [pid 6163] rt_sigprocmask(SIG_SETMASK, [], [pid 6162] <... futex resumed>) = 0 [pid 6163] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6162] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6163] memfd_create("syzkaller", 0) = 3 [pid 6163] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6163] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6163] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6163] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6163] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6163] close(3) = 0 [pid 6163] mkdir("./bus", 0777) = 0 [pid 6163] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6163] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6163] chdir("./bus") = 0 [pid 6163] ioctl(4, LOOP_CLR_FD) = 0 [pid 6163] close(4) = 0 [pid 6163] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6162] <... futex resumed>) = 0 [pid 6163] <... futex resumed>) = 1 [pid 6162] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6163] memfd_create("syzkaller", 0) = 4 [pid 6163] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6162] <... futex resumed>) = 0 [pid 6162] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6163] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6163] munmap(0x7f6d360cf000, 32768) = 0 [pid 6163] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6163] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6163] ioctl(5, LOOP_CLR_FD) = 0 [pid 6163] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6163] close(5) = 0 [pid 6163] close(4) = 0 [pid 6163] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6162] <... futex resumed>) = 0 [pid 6163] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6162] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6163] <... openat resumed>) = 4 [pid 6162] <... futex resumed>) = 0 [pid 6163] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6162] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6163] <... futex resumed>) = 0 [pid 6163] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6162] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6162] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6163] <... futex resumed>) = 0 [pid 6162] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6163] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6163] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6162] <... futex resumed>) = 0 [pid 6163] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6162] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6163] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6162] <... futex resumed>) = 0 [pid 6163] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6162] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6163] <... mmap resumed>) = 0x20000000 [pid 6163] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6162] <... futex resumed>) = 0 [pid 6162] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6162] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6163] <... futex resumed>) = 1 [pid 6163] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6163] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6163] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6162] <... futex resumed>) = 0 [pid 6163] <... futex resumed>) = 1 [pid 6162] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6163] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6162] <... futex resumed>) = 0 [pid 6163] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6162] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6163] <... openat resumed>) = 6 [pid 6162] <... futex resumed>) = 0 [pid 6162] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6162] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6163] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6162] <... mprotect resumed>) = 0 [pid 6163] <... futex resumed>) = 0 [pid 6163] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6162] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6162] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} => {parent_tid=[6164]}, 88) = 6164 ./strace-static-x86_64: Process 6164 attached [pid 6164] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6162] rt_sigprocmask(SIG_SETMASK, [], [pid 6164] <... rseq resumed>) = 0 [pid 6162] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6164] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6162] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6164] rt_sigprocmask(SIG_SETMASK, [], [pid 6162] <... futex resumed>) = 0 [pid 6164] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6162] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6164] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6164] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6162] <... futex resumed>) = 0 [pid 6164] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6162] exit_group(0 [pid 6164] <... futex resumed>) = ? [pid 6163] <... futex resumed>) = ? [pid 6162] <... exit_group resumed>) = ? [pid 6164] +++ exited with 0 +++ [pid 6163] +++ exited with 0 +++ [pid 6162] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6162, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./372", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./372", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 [ 128.728957][ T6163] loop0: detected capacity change from 0 to 64 umount2("./372/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./372/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./372/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./372/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./372/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./372/bus") = 0 umount2("./372/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./372/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./372/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./372") = 0 mkdir("./373", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6165 attached [pid 6165] set_robust_list(0x5555564f6760, 24 [pid 5037] <... clone resumed>, child_tidptr=0x5555564f6750) = 6165 [pid 6165] <... set_robust_list resumed>) = 0 [pid 6165] chdir("./373") = 0 [pid 6165] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6165] setpgid(0, 0) = 0 [pid 6165] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6165] write(3, "1000", 4) = 4 [pid 6165] close(3) = 0 [pid 6165] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6165] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6165] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6165] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6165] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6165] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6165] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6165] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6166 attached => {parent_tid=[6166]}, 88) = 6166 [pid 6165] rt_sigprocmask(SIG_SETMASK, [], [pid 6166] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6165] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6166] <... rseq resumed>) = 0 [pid 6166] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6166] rt_sigprocmask(SIG_SETMASK, [], [pid 6165] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6166] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6165] <... futex resumed>) = 0 [pid 6165] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6166] memfd_create("syzkaller", 0) = 3 [pid 6166] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6166] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6166] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6166] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6166] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6166] close(3) = 0 [pid 6166] mkdir("./bus", 0777) = 0 [pid 6166] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6166] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6166] chdir("./bus") = 0 [pid 6166] ioctl(4, LOOP_CLR_FD) = 0 [pid 6166] close(4) = 0 [pid 6166] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6166] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6165] <... futex resumed>) = 0 [pid 6165] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6166] <... futex resumed>) = 0 [pid 6165] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6166] memfd_create("syzkaller", 0) = 4 [pid 6166] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6166] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6166] munmap(0x7f6d360cf000, 32768) = 0 [pid 6166] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6166] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6166] ioctl(5, LOOP_CLR_FD) = 0 [pid 6166] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6166] close(5) = 0 [pid 6166] close(4) = 0 [pid 6166] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6166] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6165] <... futex resumed>) = 0 [pid 6165] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6166] <... futex resumed>) = 0 [pid 6165] <... futex resumed>) = 1 [pid 6166] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6166] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 128.854186][ T6166] loop0: detected capacity change from 0 to 64 [pid 6166] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6165] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 6165] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6166] <... futex resumed>) = 0 [pid 6165] <... futex resumed>) = 1 [pid 6166] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6165] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6166] <... write resumed>) = 12288 [pid 6166] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6165] <... futex resumed>) = 0 [pid 6165] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6166] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6165] <... futex resumed>) = 0 [pid 6166] <... mmap resumed>) = 0x20000000 [pid 6165] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6166] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6165] <... futex resumed>) = 0 [pid 6166] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6165] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6165] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6166] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6166] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6166] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6166] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6165] <... futex resumed>) = 0 [pid 6165] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6166] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6165] <... futex resumed>) = 0 [pid 6166] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6165] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6166] <... openat resumed>) = 6 [pid 6165] <... futex resumed>) = 0 [pid 6165] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6166] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6166] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6165] <... mmap resumed>) = 0x7f6d360b6000 [pid 6165] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6165] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6165] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6167 attached => {parent_tid=[6167]}, 88) = 6167 [pid 6167] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6167] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6167] rt_sigprocmask(SIG_SETMASK, [], [pid 6165] rt_sigprocmask(SIG_SETMASK, [], [pid 6167] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6167] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6165] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6165] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6167] <... futex resumed>) = 0 [pid 6167] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6165] <... futex resumed>) = 1 [pid 6167] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6165] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6167] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6165] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6167] <... futex resumed>) = 0 [pid 6167] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6165] exit_group(0 [pid 6167] <... futex resumed>) = ? [pid 6165] <... exit_group resumed>) = ? [pid 6167] +++ exited with 0 +++ [pid 6166] <... futex resumed>) = ? [pid 6166] +++ exited with 0 +++ [pid 6165] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6165, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./373", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./373", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./373/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./373/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./373/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./373/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./373/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./373/bus") = 0 umount2("./373/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./373/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./373/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./373") = 0 mkdir("./374", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6168 attached , child_tidptr=0x5555564f6750) = 6168 [pid 6168] set_robust_list(0x5555564f6760, 24) = 0 [pid 6168] chdir("./374") = 0 [pid 6168] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6168] setpgid(0, 0) = 0 [pid 6168] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6168] write(3, "1000", 4) = 4 [pid 6168] close(3) = 0 [pid 6168] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6168] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6168] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6168] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6168] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6168] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6168] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6168] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0} => {parent_tid=[6169]}, 88) = 6169 ./strace-static-x86_64: Process 6169 attached [pid 6168] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6168] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6168] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6169] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6169] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6169] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6169] memfd_create("syzkaller", 0) = 3 [pid 6169] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6169] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6169] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6169] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6169] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6169] close(3) = 0 [pid 6169] mkdir("./bus", 0777) = 0 [pid 6169] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6169] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6169] chdir("./bus") = 0 [pid 6169] ioctl(4, LOOP_CLR_FD) = 0 [pid 6169] close(4) = 0 [pid 6169] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6169] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6168] <... futex resumed>) = 0 [pid 6168] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6169] <... futex resumed>) = 0 [pid 6168] <... futex resumed>) = 1 [pid 6168] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6169] memfd_create("syzkaller", 0) = 4 [pid 6169] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6169] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6169] munmap(0x7f6d360cf000, 32768) = 0 [pid 6169] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6169] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6169] ioctl(5, LOOP_CLR_FD) = 0 [pid 6169] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6169] close(5) = 0 [pid 6169] close(4) = 0 [pid 6169] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6168] <... futex resumed>) = 0 [pid 6169] <... futex resumed>) = 1 [pid 6168] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6169] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6168] <... futex resumed>) = 0 [pid 6168] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6169] <... openat resumed>) = 4 [pid 6169] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6168] <... futex resumed>) = 0 [pid 6168] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6169] <... futex resumed>) = 1 [pid 6168] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6169] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6169] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6168] <... futex resumed>) = 0 [pid 6168] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6169] <... futex resumed>) = 1 [pid 6168] <... futex resumed>) = 0 [pid 6169] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6168] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6169] <... mmap resumed>) = 0x20000000 [pid 6169] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6168] <... futex resumed>) = 0 [pid 6168] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6169] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6168] <... futex resumed>) = 0 [pid 6168] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6169] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6169] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6168] <... futex resumed>) = 0 [pid 6169] <... futex resumed>) = 1 [pid 6168] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6169] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6168] <... futex resumed>) = 0 [pid 6168] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6169] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6168] <... futex resumed>) = 0 [pid 6169] <... openat resumed>) = 6 [pid 6168] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6168] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6169] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6168] <... mprotect resumed>) = 0 [pid 6169] <... futex resumed>) = 0 [ 129.007098][ T6169] loop0: detected capacity change from 0 to 64 [pid 6169] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6168] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6168] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6170 attached => {parent_tid=[6170]}, 88) = 6170 [pid 6168] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6168] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6168] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6170] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6170] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6170] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6170] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6170] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6168] <... futex resumed>) = 0 [pid 6170] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6168] exit_group(0) = ? [pid 6169] <... futex resumed>) = ? [pid 6170] <... futex resumed>) = ? [pid 6170] +++ exited with 0 +++ [pid 6169] +++ exited with 0 +++ [pid 6168] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6168, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./374", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./374", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./374/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./374/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./374/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./374/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./374/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./374/bus") = 0 umount2("./374/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./374/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./374/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./374") = 0 mkdir("./375", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6171 attached , child_tidptr=0x5555564f6750) = 6171 [pid 6171] set_robust_list(0x5555564f6760, 24) = 0 [pid 6171] chdir("./375") = 0 [pid 6171] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6171] setpgid(0, 0) = 0 [pid 6171] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6171] write(3, "1000", 4) = 4 [pid 6171] close(3) = 0 [pid 6171] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6171] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6171] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6171] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6171] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6171] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6171] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6171] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0} => {parent_tid=[6172]}, 88) = 6172 ./strace-static-x86_64: Process 6172 attached [pid 6171] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6171] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6171] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6172] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6172] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6172] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6172] memfd_create("syzkaller", 0) = 3 [pid 6172] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6172] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6172] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6172] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6172] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6172] close(3) = 0 [pid 6172] mkdir("./bus", 0777) = 0 [pid 6172] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6172] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6172] chdir("./bus") = 0 [pid 6172] ioctl(4, LOOP_CLR_FD) = 0 [pid 6172] close(4) = 0 [pid 6172] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6172] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6171] <... futex resumed>) = 0 [pid 6171] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6171] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6172] <... futex resumed>) = 0 [pid 6172] memfd_create("syzkaller", 0) = 4 [pid 6172] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6172] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6172] munmap(0x7f6d360cf000, 32768) = 0 [pid 6172] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6172] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6172] ioctl(5, LOOP_CLR_FD) = 0 [pid 6172] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6172] close(5) = 0 [pid 6172] close(4) = 0 [pid 6172] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6171] <... futex resumed>) = 0 [pid 6172] <... futex resumed>) = 1 [pid 6171] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6172] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6171] <... futex resumed>) = 0 [pid 6171] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6172] <... openat resumed>) = 4 [pid 6172] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6171] <... futex resumed>) = 0 [pid 6172] <... futex resumed>) = 1 [pid 6171] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6172] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6171] <... futex resumed>) = 0 [pid 6172] <... write resumed>) = 12288 [pid 6171] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6172] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6171] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6172] <... futex resumed>) = 0 [pid 6171] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6172] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6171] <... futex resumed>) = 0 [pid 6172] <... mmap resumed>) = 0x20000000 [pid 6171] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6172] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6171] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6172] <... futex resumed>) = 0 [pid 6171] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6172] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6171] <... futex resumed>) = 0 [pid 6172] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6171] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6172] <... openat resumed>) = 5 [pid 6172] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6171] <... futex resumed>) = 0 [pid 6172] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6171] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6172] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6171] <... futex resumed>) = 0 [pid 6171] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6171] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6172] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6172] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6171] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6171] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6172] <... openat resumed>) = 6 [pid 6171] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6172] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6171] <... clone3 resumed> => {parent_tid=[6173]}, 88) = 6173 [pid 6171] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 6173 attached [pid 6172] <... futex resumed>) = 0 [pid 6173] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6172] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6171] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6173] <... rseq resumed>) = 0 [pid 6173] set_robust_list(0x7f6d360d69a0, 24 [pid 6171] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6173] <... set_robust_list resumed>) = 0 [pid 6171] <... futex resumed>) = 0 [pid 6173] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6171] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6173] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6173] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6173] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6171] <... futex resumed>) = 0 [pid 6171] exit_group(0) = ? [pid 6173] <... futex resumed>) = ? [pid 6172] <... futex resumed>) = ? [pid 6173] +++ exited with 0 +++ [ 129.127196][ T6172] loop0: detected capacity change from 0 to 64 [pid 6172] +++ exited with 0 +++ [pid 6171] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6171, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./375", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./375", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./375/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./375/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./375/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./375/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./375/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./375/bus") = 0 umount2("./375/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./375/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./375/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./375") = 0 mkdir("./376", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6174 attached [pid 6174] set_robust_list(0x5555564f6760, 24) = 0 [pid 5037] <... clone resumed>, child_tidptr=0x5555564f6750) = 6174 [pid 6174] chdir("./376") = 0 [pid 6174] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6174] setpgid(0, 0) = 0 [pid 6174] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6174] write(3, "1000", 4) = 4 [pid 6174] close(3) = 0 [pid 6174] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6174] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6174] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6174] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6174] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6174] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6174] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6174] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6175 attached [pid 6175] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6174] <... clone3 resumed> => {parent_tid=[6175]}, 88) = 6175 [pid 6175] <... rseq resumed>) = 0 [pid 6175] set_robust_list(0x7f6d468e79a0, 24 [pid 6174] rt_sigprocmask(SIG_SETMASK, [], [pid 6175] <... set_robust_list resumed>) = 0 [pid 6175] rt_sigprocmask(SIG_SETMASK, [], [pid 6174] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6175] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6174] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6175] memfd_create("syzkaller", 0 [pid 6174] <... futex resumed>) = 0 [pid 6174] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6175] <... memfd_create resumed>) = 3 [pid 6175] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6175] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6175] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6175] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6175] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6175] close(3) = 0 [pid 6175] mkdir("./bus", 0777) = 0 [pid 6175] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6175] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6175] chdir("./bus") = 0 [pid 6175] ioctl(4, LOOP_CLR_FD) = 0 [pid 6175] close(4) = 0 [pid 6175] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6174] <... futex resumed>) = 0 [pid 6174] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6174] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6175] <... futex resumed>) = 1 [pid 6175] memfd_create("syzkaller", 0) = 4 [pid 6175] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6175] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6175] munmap(0x7f6d360cf000, 32768) = 0 [pid 6175] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6175] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6175] ioctl(5, LOOP_CLR_FD) = 0 [pid 6175] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6175] close(5) = 0 [pid 6175] close(4) = 0 [pid 6175] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6174] <... futex resumed>) = 0 [pid 6175] <... futex resumed>) = 1 [pid 6174] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6175] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6174] <... futex resumed>) = 0 [pid 6175] <... openat resumed>) = 4 [pid 6174] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6175] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6174] <... futex resumed>) = 0 [pid 6174] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6174] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6175] <... futex resumed>) = 1 [pid 6175] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6175] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6174] <... futex resumed>) = 0 [pid 6174] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6174] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6175] <... futex resumed>) = 1 [pid 6175] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6175] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6174] <... futex resumed>) = 0 [pid 6174] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6174] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6175] <... futex resumed>) = 1 [pid 6175] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6175] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6175] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6174] <... futex resumed>) = 0 [pid 6175] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6174] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6174] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6175] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6174] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6175] <... openat resumed>) = 6 [pid 6174] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6174] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6175] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6174] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6176 attached [pid 6175] <... futex resumed>) = 0 [pid 6176] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6174] <... clone3 resumed> => {parent_tid=[6176]}, 88) = 6176 [pid 6176] <... rseq resumed>) = 0 [pid 6174] rt_sigprocmask(SIG_SETMASK, [], [pid 6176] set_robust_list(0x7f6d360d69a0, 24 [pid 6174] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6176] <... set_robust_list resumed>) = 0 [pid 6174] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6176] rt_sigprocmask(SIG_SETMASK, [], [pid 6174] <... futex resumed>) = 0 [pid 6176] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6174] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6176] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6175] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6176] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6176] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [ 129.251145][ T6175] loop0: detected capacity change from 0 to 64 [pid 6176] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6174] <... futex resumed>) = 0 [pid 6174] exit_group(0 [pid 6176] <... futex resumed>) = ? [pid 6175] <... futex resumed>) = ? [pid 6174] <... exit_group resumed>) = ? [pid 6176] +++ exited with 0 +++ [pid 6175] +++ exited with 0 +++ [pid 6174] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6174, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./376", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./376", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./376/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./376/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./376/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./376/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./376/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./376/bus") = 0 umount2("./376/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./376/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./376/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./376") = 0 mkdir("./377", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6177 attached , child_tidptr=0x5555564f6750) = 6177 [pid 6177] set_robust_list(0x5555564f6760, 24) = 0 [pid 6177] chdir("./377") = 0 [pid 6177] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6177] setpgid(0, 0) = 0 [pid 6177] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6177] write(3, "1000", 4) = 4 [pid 6177] close(3) = 0 [pid 6177] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6177] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6177] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6177] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6177] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6177] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6177] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6177] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6178 attached => {parent_tid=[6178]}, 88) = 6178 [pid 6177] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6177] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6178] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6177] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6178] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6178] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6178] memfd_create("syzkaller", 0) = 3 [pid 6178] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6178] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6178] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6178] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6178] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6178] close(3) = 0 [pid 6178] mkdir("./bus", 0777) = 0 [pid 6178] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6178] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6178] chdir("./bus") = 0 [pid 6178] ioctl(4, LOOP_CLR_FD) = 0 [pid 6178] close(4) = 0 [pid 6178] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6178] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6177] <... futex resumed>) = 0 [pid 6177] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6178] <... futex resumed>) = 0 [pid 6177] <... futex resumed>) = 1 [pid 6178] memfd_create("syzkaller", 0 [pid 6177] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6178] <... memfd_create resumed>) = 4 [pid 6178] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6178] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6178] munmap(0x7f6d360cf000, 32768) = 0 [pid 6178] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6178] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6178] ioctl(5, LOOP_CLR_FD) = 0 [pid 6178] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6178] close(5) = 0 [ 129.402606][ T6178] loop0: detected capacity change from 0 to 64 [pid 6178] close(4) = 0 [pid 6178] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6178] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6177] <... futex resumed>) = 0 [pid 6177] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6178] <... futex resumed>) = 0 [pid 6178] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6177] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6178] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6177] <... futex resumed>) = 0 [pid 6177] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6177] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6178] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6178] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6177] <... futex resumed>) = 0 [pid 6178] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6177] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6178] <... futex resumed>) = 0 [pid 6177] <... futex resumed>) = 1 [pid 6178] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6177] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6178] <... mmap resumed>) = 0x20000000 [pid 6178] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6177] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6177] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6177] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6178] <... futex resumed>) = 1 [pid 6177] <... futex resumed>) = 0 [pid 6177] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6178] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6178] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6178] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6177] <... futex resumed>) = 0 [pid 6177] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6177] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6177] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6178] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6177] <... mmap resumed>) = 0x7f6d360b6000 [pid 6177] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6178] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6177] <... mprotect resumed>) = 0 [pid 6177] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6177] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6179 attached [pid 6179] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6177] <... clone3 resumed> => {parent_tid=[6179]}, 88) = 6179 [pid 6179] <... rseq resumed>) = 0 [pid 6177] rt_sigprocmask(SIG_SETMASK, [], [pid 6179] set_robust_list(0x7f6d360d69a0, 24 [pid 6177] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6179] <... set_robust_list resumed>) = 0 [pid 6179] rt_sigprocmask(SIG_SETMASK, [], [pid 6177] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6179] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6179] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6177] <... futex resumed>) = 0 [pid 6179] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6177] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6179] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6177] <... futex resumed>) = 0 [pid 6179] <... futex resumed>) = 1 [pid 6179] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6178] <... openat resumed>) = 6 [pid 6178] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6178] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6177] exit_group(0 [pid 6179] <... futex resumed>) = ? [pid 6178] <... futex resumed>) = ? [pid 6177] <... exit_group resumed>) = ? [pid 6178] +++ exited with 0 +++ [pid 6179] +++ exited with 0 +++ [pid 6177] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6177, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./377", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./377", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./377/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./377/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./377/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./377/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./377/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./377/bus") = 0 umount2("./377/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./377/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./377/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./377") = 0 mkdir("./378", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6180 attached [pid 6180] set_robust_list(0x5555564f6760, 24) = 0 [pid 5037] <... clone resumed>, child_tidptr=0x5555564f6750) = 6180 [pid 6180] chdir("./378") = 0 [pid 6180] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6180] setpgid(0, 0) = 0 [pid 6180] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6180] write(3, "1000", 4) = 4 [pid 6180] close(3) = 0 [pid 6180] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6180] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6180] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6180] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6180] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6180] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6180] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6180] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6181 attached [pid 6181] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6180] <... clone3 resumed> => {parent_tid=[6181]}, 88) = 6181 [pid 6181] <... rseq resumed>) = 0 [pid 6180] rt_sigprocmask(SIG_SETMASK, [], [pid 6181] set_robust_list(0x7f6d468e79a0, 24 [pid 6180] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6181] <... set_robust_list resumed>) = 0 [pid 6180] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6181] rt_sigprocmask(SIG_SETMASK, [], [pid 6180] <... futex resumed>) = 0 [pid 6181] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6181] memfd_create("syzkaller", 0 [pid 6180] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6181] <... memfd_create resumed>) = 3 [pid 6181] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6181] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6181] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6181] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6181] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6181] close(3) = 0 [pid 6181] mkdir("./bus", 0777) = 0 [pid 6181] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6181] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6181] chdir("./bus") = 0 [pid 6181] ioctl(4, LOOP_CLR_FD) = 0 [pid 6181] close(4) = 0 [pid 6181] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6180] <... futex resumed>) = 0 [pid 6181] <... futex resumed>) = 1 [pid 6180] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6181] memfd_create("syzkaller", 0 [pid 6180] <... futex resumed>) = 0 [pid 6181] <... memfd_create resumed>) = 4 [pid 6180] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6181] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6181] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6181] munmap(0x7f6d360cf000, 32768) = 0 [pid 6181] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6181] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6181] ioctl(5, LOOP_CLR_FD) = 0 [pid 6181] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6181] close(5) = 0 [pid 6181] close(4) = 0 [pid 6181] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6180] <... futex resumed>) = 0 [pid 6181] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6180] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6181] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6181] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6180] <... futex resumed>) = 0 [pid 6181] <... openat resumed>) = 4 [pid 6180] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6181] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6180] <... futex resumed>) = 0 [pid 6181] <... futex resumed>) = 1 [pid 6180] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6181] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6180] <... futex resumed>) = 0 [pid 6181] <... write resumed>) = 12288 [pid 6180] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6181] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6180] <... futex resumed>) = 0 [pid 6180] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6181] <... futex resumed>) = 1 [pid 6180] <... futex resumed>) = 0 [pid 6181] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6180] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6181] <... mmap resumed>) = 0x20000000 [pid 6181] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6181] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6180] <... futex resumed>) = 0 [pid 6180] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6181] <... futex resumed>) = 0 [pid 6181] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6181] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6180] <... futex resumed>) = 1 [pid 6181] <... openat resumed>) = 5 [ 129.527896][ T6181] loop0: detected capacity change from 0 to 64 [pid 6180] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6181] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6180] <... futex resumed>) = 0 [pid 6180] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6181] <... futex resumed>) = 1 [pid 6180] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6181] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6180] <... futex resumed>) = 0 [pid 6180] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6181] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6180] <... mmap resumed>) = 0x7f6d360b6000 [pid 6180] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6181] <... openat resumed>) = 6 [pid 6181] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6181] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6180] <... mprotect resumed>) = 0 [pid 6180] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6180] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} => {parent_tid=[6182]}, 88) = 6182 [pid 6180] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6180] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 6182 attached [pid 6180] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6182] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6182] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6182] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6182] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6182] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6180] <... futex resumed>) = 0 [pid 6182] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6180] exit_group(0) = ? [pid 6182] <... futex resumed>) = ? [pid 6181] <... futex resumed>) = ? [pid 6182] +++ exited with 0 +++ [pid 6181] +++ exited with 0 +++ [pid 6180] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6180, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./378", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./378", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./378/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./378/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./378/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./378/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./378/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./378/bus") = 0 umount2("./378/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./378/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./378/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./378") = 0 mkdir("./379", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6183 attached , child_tidptr=0x5555564f6750) = 6183 [pid 6183] set_robust_list(0x5555564f6760, 24) = 0 [pid 6183] chdir("./379") = 0 [pid 6183] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6183] setpgid(0, 0) = 0 [pid 6183] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6183] write(3, "1000", 4) = 4 [pid 6183] close(3) = 0 [pid 6183] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6183] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6183] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6183] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6183] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6183] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6183] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6183] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6184 attached => {parent_tid=[6184]}, 88) = 6184 [pid 6183] rt_sigprocmask(SIG_SETMASK, [], [pid 6184] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6183] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6183] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6183] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6184] <... rseq resumed>) = 0 [pid 6184] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6184] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6184] memfd_create("syzkaller", 0) = 3 [pid 6184] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6184] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6184] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6184] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6184] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6184] close(3) = 0 [pid 6184] mkdir("./bus", 0777) = 0 [pid 6184] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6184] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6184] chdir("./bus") = 0 [pid 6184] ioctl(4, LOOP_CLR_FD) = 0 [pid 6184] close(4) = 0 [pid 6184] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6184] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6183] <... futex resumed>) = 0 [pid 6183] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6183] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6184] <... futex resumed>) = 0 [pid 6184] memfd_create("syzkaller", 0) = 4 [pid 6184] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6184] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6184] munmap(0x7f6d360cf000, 32768) = 0 [pid 6184] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6184] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6184] ioctl(5, LOOP_CLR_FD) = 0 [pid 6184] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6184] close(5) = 0 [pid 6184] close(4) = 0 [pid 6184] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6183] <... futex resumed>) = 0 [pid 6184] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6183] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6184] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6183] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6184] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6184] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6183] <... futex resumed>) = 0 [pid 6184] <... futex resumed>) = 1 [pid 6183] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6184] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6183] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6184] <... write resumed>) = 12288 [ 129.655424][ T6184] loop0: detected capacity change from 0 to 64 [pid 6184] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6183] <... futex resumed>) = 0 [pid 6184] <... futex resumed>) = 1 [pid 6183] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6184] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6183] <... futex resumed>) = 0 [pid 6184] <... mmap resumed>) = 0x20000000 [pid 6183] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6184] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6183] <... futex resumed>) = 0 [pid 6184] <... futex resumed>) = 1 [pid 6183] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6184] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6183] <... futex resumed>) = 0 [pid 6184] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6183] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6184] <... openat resumed>) = 5 [pid 6184] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6183] <... futex resumed>) = 0 [pid 6184] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6183] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6184] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6183] <... futex resumed>) = 0 [pid 6184] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6183] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6184] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6183] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6183] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6184] <... openat resumed>) = 6 [pid 6183] <... mprotect resumed>) = 0 [pid 6183] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6184] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6183] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6183] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6184] <... futex resumed>) = 0 ./strace-static-x86_64: Process 6185 attached [pid 6184] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6185] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6183] <... clone3 resumed> => {parent_tid=[6185]}, 88) = 6185 [pid 6183] rt_sigprocmask(SIG_SETMASK, [], [pid 6185] <... rseq resumed>) = 0 [pid 6183] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6185] set_robust_list(0x7f6d360d69a0, 24 [pid 6183] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6185] <... set_robust_list resumed>) = 0 [pid 6183] <... futex resumed>) = 0 [pid 6185] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6183] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6185] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6185] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6183] <... futex resumed>) = 0 [pid 6185] <... futex resumed>) = 1 [pid 6183] exit_group(0 [pid 6185] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL) = ? [pid 6185] +++ exited with 0 +++ [pid 6184] <... futex resumed>) = ? [pid 6183] <... exit_group resumed>) = ? [pid 6184] +++ exited with 0 +++ [pid 6183] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6183, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./379", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./379", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./379/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./379/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./379/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./379/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./379/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./379/bus") = 0 umount2("./379/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./379/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./379/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./379") = 0 mkdir("./380", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6186 attached , child_tidptr=0x5555564f6750) = 6186 [pid 6186] set_robust_list(0x5555564f6760, 24) = 0 [pid 6186] chdir("./380") = 0 [pid 6186] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6186] setpgid(0, 0) = 0 [pid 6186] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6186] write(3, "1000", 4) = 4 [pid 6186] close(3) = 0 [pid 6186] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6186] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6186] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6186] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6186] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6186] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6186] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6186] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6187 attached [pid 6187] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6186] <... clone3 resumed> => {parent_tid=[6187]}, 88) = 6187 [pid 6187] set_robust_list(0x7f6d468e79a0, 24 [pid 6186] rt_sigprocmask(SIG_SETMASK, [], [pid 6187] <... set_robust_list resumed>) = 0 [pid 6186] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6187] rt_sigprocmask(SIG_SETMASK, [], [pid 6186] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6187] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6186] <... futex resumed>) = 0 [pid 6187] memfd_create("syzkaller", 0 [pid 6186] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6187] <... memfd_create resumed>) = 3 [pid 6187] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6187] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6187] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6187] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6187] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6187] close(3) = 0 [pid 6187] mkdir("./bus", 0777) = 0 [pid 6187] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6187] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6187] chdir("./bus") = 0 [pid 6187] ioctl(4, LOOP_CLR_FD) = 0 [pid 6187] close(4) = 0 [pid 6187] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6187] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6186] <... futex resumed>) = 0 [pid 6186] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6187] <... futex resumed>) = 0 [pid 6186] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6187] memfd_create("syzkaller", 0) = 4 [pid 6187] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6187] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6187] munmap(0x7f6d360cf000, 32768) = 0 [pid 6187] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6187] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6187] ioctl(5, LOOP_CLR_FD) = 0 [pid 6187] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6187] close(5) = 0 [pid 6187] close(4) = 0 [pid 6187] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6186] <... futex resumed>) = 0 [pid 6187] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6186] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6186] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6187] <... openat resumed>) = 4 [pid 6187] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6186] <... futex resumed>) = 0 [pid 6186] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6186] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6187] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6187] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6186] <... futex resumed>) = 0 [pid 6186] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6186] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6187] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6187] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6187] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6186] <... futex resumed>) = 0 [pid 6186] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6187] <... futex resumed>) = 0 [pid 6186] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6187] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6187] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6187] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6186] <... futex resumed>) = 0 [pid 6187] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6186] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6187] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6186] <... futex resumed>) = 0 [pid 6187] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6186] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6187] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6186] <... futex resumed>) = 0 [pid 6186] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6187] <... openat resumed>) = 6 [pid 6187] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6186] <... mmap resumed>) = 0x7f6d360b6000 [pid 6187] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6186] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6186] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6186] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6188 attached [pid 6188] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6186] <... clone3 resumed> => {parent_tid=[6188]}, 88) = 6188 [pid 6188] <... rseq resumed>) = 0 [pid 6188] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6186] rt_sigprocmask(SIG_SETMASK, [], [pid 6188] rt_sigprocmask(SIG_SETMASK, [], [pid 6186] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6188] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 129.799664][ T6187] loop0: detected capacity change from 0 to 64 [pid 6188] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6186] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6186] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6188] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6188] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6188] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6186] <... futex resumed>) = 0 [pid 6188] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6186] exit_group(0) = ? [pid 6187] <... futex resumed>) = ? [pid 6188] <... futex resumed>) = ? [pid 6187] +++ exited with 0 +++ [pid 6188] +++ exited with 0 +++ [pid 6186] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6186, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./380", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./380", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./380/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./380/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./380/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./380/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./380/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./380/bus") = 0 umount2("./380/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./380/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./380/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./380") = 0 mkdir("./381", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6189 attached , child_tidptr=0x5555564f6750) = 6189 [pid 6189] set_robust_list(0x5555564f6760, 24) = 0 [pid 6189] chdir("./381") = 0 [pid 6189] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6189] setpgid(0, 0) = 0 [pid 6189] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6189] write(3, "1000", 4) = 4 [pid 6189] close(3) = 0 [pid 6189] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6189] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6189] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6189] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6189] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6189] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6189] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6189] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6190 attached [pid 6190] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6190] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6190] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6190] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6189] <... clone3 resumed> => {parent_tid=[6190]}, 88) = 6190 [pid 6189] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6189] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6189] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6190] <... futex resumed>) = 0 [pid 6190] memfd_create("syzkaller", 0) = 3 [pid 6190] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6190] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6190] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6190] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6190] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6190] close(3) = 0 [pid 6190] mkdir("./bus", 0777) = 0 [pid 6190] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6190] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6190] chdir("./bus") = 0 [pid 6190] ioctl(4, LOOP_CLR_FD) = 0 [pid 6190] close(4) = 0 [pid 6190] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6190] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6189] <... futex resumed>) = 0 [pid 6189] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6190] <... futex resumed>) = 0 [pid 6189] <... futex resumed>) = 1 [pid 6190] memfd_create("syzkaller", 0 [pid 6189] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6190] <... memfd_create resumed>) = 4 [pid 6190] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6190] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6190] munmap(0x7f6d360cf000, 32768) = 0 [pid 6190] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6190] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6190] ioctl(5, LOOP_CLR_FD) = 0 [pid 6190] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6190] close(5) = 0 [pid 6190] close(4) = 0 [pid 6190] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6189] <... futex resumed>) = 0 [pid 6189] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6190] <... futex resumed>) = 1 [pid 6189] <... futex resumed>) = 0 [pid 6190] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6189] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6190] <... openat resumed>) = 4 [pid 6190] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6189] <... futex resumed>) = 0 [pid 6189] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6190] <... futex resumed>) = 1 [pid 6189] <... futex resumed>) = 0 [pid 6190] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6189] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6190] <... write resumed>) = 12288 [pid 6190] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6189] <... futex resumed>) = 0 [pid 6190] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6189] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6190] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6189] <... futex resumed>) = 0 [pid 6190] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6189] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6190] <... mmap resumed>) = 0x20000000 [pid 6190] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6189] <... futex resumed>) = 0 [pid 6189] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6190] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6189] <... futex resumed>) = 0 [pid 6189] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6190] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6190] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6189] <... futex resumed>) = 0 [pid 6189] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6190] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6190] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6189] <... futex resumed>) = 0 [pid 6189] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6189] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [ 129.937499][ T6190] loop0: detected capacity change from 0 to 64 [pid 6189] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6190] <... openat resumed>) = 6 [pid 6189] <... mprotect resumed>) = 0 [pid 6190] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6190] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6189] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6189] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6191 attached [pid 6191] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6189] <... clone3 resumed> => {parent_tid=[6191]}, 88) = 6191 [pid 6191] <... rseq resumed>) = 0 [pid 6191] set_robust_list(0x7f6d360d69a0, 24 [pid 6189] rt_sigprocmask(SIG_SETMASK, [], [pid 6191] <... set_robust_list resumed>) = 0 [pid 6189] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6191] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6191] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6189] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6191] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6191] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6189] <... futex resumed>) = 0 [pid 6189] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 6191] <... futex resumed>) = 0 [pid 6191] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6189] exit_group(0 [pid 6191] <... futex resumed>) = ? [pid 6189] <... exit_group resumed>) = ? [pid 6191] +++ exited with 0 +++ [pid 6190] <... futex resumed>) = ? [pid 6190] +++ exited with 0 +++ [pid 6189] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6189, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./381", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./381", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./381/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./381/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./381/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./381/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./381/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./381/bus") = 0 umount2("./381/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./381/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./381/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./381") = 0 mkdir("./382", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6192 ./strace-static-x86_64: Process 6192 attached [pid 6192] set_robust_list(0x5555564f6760, 24) = 0 [pid 6192] chdir("./382") = 0 [pid 6192] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6192] setpgid(0, 0) = 0 [pid 6192] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6192] write(3, "1000", 4) = 4 [pid 6192] close(3) = 0 [pid 6192] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6192] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6192] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6192] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6192] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6192] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6192] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6192] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6193 attached => {parent_tid=[6193]}, 88) = 6193 [pid 6192] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6192] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6192] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6193] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6193] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6193] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6193] memfd_create("syzkaller", 0) = 3 [pid 6193] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6193] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6193] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6193] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6193] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6193] close(3) = 0 [pid 6193] mkdir("./bus", 0777) = 0 [pid 6193] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6193] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6193] chdir("./bus") = 0 [pid 6193] ioctl(4, LOOP_CLR_FD) = 0 [pid 6193] close(4) = 0 [pid 6193] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6193] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6192] <... futex resumed>) = 0 [pid 6192] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6193] <... futex resumed>) = 0 [pid 6192] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6193] memfd_create("syzkaller", 0) = 4 [pid 6193] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6193] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6193] munmap(0x7f6d360cf000, 32768) = 0 [pid 6193] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6193] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6193] ioctl(5, LOOP_CLR_FD) = 0 [pid 6193] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6193] close(5) = 0 [pid 6193] close(4) = 0 [pid 6193] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6192] <... futex resumed>) = 0 [pid 6193] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6192] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6193] <... openat resumed>) = 4 [pid 6192] <... futex resumed>) = 0 [pid 6192] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6193] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6192] <... futex resumed>) = 0 [pid 6192] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6192] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6193] <... futex resumed>) = 1 [pid 6193] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6193] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6192] <... futex resumed>) = 0 [pid 6192] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6192] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6193] <... futex resumed>) = 1 [pid 6193] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6193] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6192] <... futex resumed>) = 0 [pid 6192] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6193] <... futex resumed>) = 1 [pid 6192] <... futex resumed>) = 0 [pid 6193] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6192] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6193] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6193] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6192] <... futex resumed>) = 0 [pid 6192] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6193] <... futex resumed>) = 1 [pid 6192] <... futex resumed>) = 0 [pid 6193] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6192] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6193] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6192] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6193] <... openat resumed>) = 6 [pid 6192] <... mmap resumed>) = 0x7f6d360b6000 [pid 6193] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6193] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6192] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6192] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6192] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6194 attached [pid 6194] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6192] <... clone3 resumed> => {parent_tid=[6194]}, 88) = 6194 [pid 6194] set_robust_list(0x7f6d360d69a0, 24 [pid 6192] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6192] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6192] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6194] <... set_robust_list resumed>) = 0 [pid 6194] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6194] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6194] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6192] <... futex resumed>) = 0 [pid 6194] <... futex resumed>) = 1 [pid 6194] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6192] exit_group(0 [pid 6193] <... futex resumed>) = ? [pid 6192] <... exit_group resumed>) = ? [pid 6194] <... futex resumed>) = ? [pid 6193] +++ exited with 0 +++ [pid 6194] +++ exited with 0 +++ [pid 6192] +++ exited with 0 +++ [ 130.066181][ T6193] loop0: detected capacity change from 0 to 64 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6192, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./382", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./382", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./382/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./382/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./382/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./382/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./382/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./382/bus") = 0 umount2("./382/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./382/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./382/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./382") = 0 mkdir("./383", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6195 attached [pid 6195] set_robust_list(0x5555564f6760, 24) = 0 [pid 6195] chdir("./383") = 0 [pid 6195] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6195] setpgid(0, 0) = 0 [pid 6195] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6195] write(3, "1000", 4) = 4 [pid 6195] close(3) = 0 [pid 6195] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6195] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6195] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6195] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6195] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6195] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6195] rt_sigprocmask(SIG_BLOCK, ~[], [pid 5037] <... clone resumed>, child_tidptr=0x5555564f6750) = 6195 [pid 6195] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6195] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0} => {parent_tid=[6196]}, 88) = 6196 ./strace-static-x86_64: Process 6196 attached [pid 6196] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6196] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6196] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6196] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6195] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6195] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6196] <... futex resumed>) = 0 [pid 6195] <... futex resumed>) = 1 [pid 6196] memfd_create("syzkaller", 0 [pid 6195] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6196] <... memfd_create resumed>) = 3 [pid 6196] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6196] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6196] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6196] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6196] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6196] close(3) = 0 [pid 6196] mkdir("./bus", 0777) = 0 [pid 6196] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6196] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6196] chdir("./bus") = 0 [pid 6196] ioctl(4, LOOP_CLR_FD) = 0 [pid 6196] close(4) = 0 [pid 6196] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6195] <... futex resumed>) = 0 [pid 6195] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6195] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6196] <... futex resumed>) = 1 [pid 6196] memfd_create("syzkaller", 0) = 4 [pid 6196] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6196] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6196] munmap(0x7f6d360cf000, 32768) = 0 [pid 6196] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6196] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6196] ioctl(5, LOOP_CLR_FD) = 0 [pid 6196] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6196] close(5) = 0 [pid 6196] close(4) = 0 [pid 6196] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6195] <... futex resumed>) = 0 [pid 6195] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6195] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6196] <... futex resumed>) = 1 [pid 6196] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6196] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6195] <... futex resumed>) = 0 [pid 6195] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6195] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6196] <... futex resumed>) = 1 [pid 6196] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6196] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6195] <... futex resumed>) = 0 [pid 6195] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6195] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6196] <... futex resumed>) = 1 [pid 6196] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6196] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6195] <... futex resumed>) = 0 [pid 6195] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6195] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6196] <... futex resumed>) = 1 [pid 6196] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6196] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6196] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6195] <... futex resumed>) = 0 [pid 6195] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6195] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6195] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6195] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6196] <... futex resumed>) = 1 [pid 6195] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6195] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6197 attached [pid 6196] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6197] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6196] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6197] <... rseq resumed>) = 0 [pid 6196] <... openat resumed>) = 6 [pid 6195] <... clone3 resumed> => {parent_tid=[6197]}, 88) = 6197 [pid 6197] set_robust_list(0x7f6d360d69a0, 24 [pid 6195] rt_sigprocmask(SIG_SETMASK, [], [pid 6197] <... set_robust_list resumed>) = 0 [pid 6195] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6197] rt_sigprocmask(SIG_SETMASK, [], [pid 6195] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6197] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6195] <... futex resumed>) = 0 [pid 6197] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6195] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6196] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6197] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6196] <... futex resumed>) = 0 [pid 6196] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6197] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6195] <... futex resumed>) = 0 [pid 6197] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6195] exit_group(0 [pid 6197] <... futex resumed>) = ? [pid 6196] <... futex resumed>) = ? [ 130.188573][ T6196] loop0: detected capacity change from 0 to 64 [pid 6197] +++ exited with 0 +++ [pid 6196] +++ exited with 0 +++ [pid 6195] <... exit_group resumed>) = ? [pid 6195] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6195, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./383", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./383", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./383/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./383/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./383/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./383/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./383/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./383/bus") = 0 umount2("./383/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./383/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./383/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./383") = 0 mkdir("./384", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6198 attached , child_tidptr=0x5555564f6750) = 6198 [pid 6198] set_robust_list(0x5555564f6760, 24) = 0 [pid 6198] chdir("./384") = 0 [pid 6198] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6198] setpgid(0, 0) = 0 [pid 6198] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6198] write(3, "1000", 4) = 4 [pid 6198] close(3) = 0 [pid 6198] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6198] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6198] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6198] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6198] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6198] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6198] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6198] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6199 attached => {parent_tid=[6199]}, 88) = 6199 [pid 6199] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6198] rt_sigprocmask(SIG_SETMASK, [], [pid 6199] set_robust_list(0x7f6d468e79a0, 24 [pid 6198] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6199] <... set_robust_list resumed>) = 0 [pid 6198] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6199] rt_sigprocmask(SIG_SETMASK, [], [pid 6198] <... futex resumed>) = 0 [pid 6199] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6198] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6199] memfd_create("syzkaller", 0) = 3 [pid 6199] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6199] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6199] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6199] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6199] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6199] close(3) = 0 [pid 6199] mkdir("./bus", 0777) = 0 [pid 6199] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6199] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6199] chdir("./bus") = 0 [pid 6199] ioctl(4, LOOP_CLR_FD) = 0 [pid 6199] close(4) = 0 [pid 6199] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6198] <... futex resumed>) = 0 [pid 6199] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6198] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6199] <... futex resumed>) = 0 [pid 6198] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6199] memfd_create("syzkaller", 0) = 4 [pid 6199] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6199] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6199] munmap(0x7f6d360cf000, 32768) = 0 [pid 6199] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6199] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6199] ioctl(5, LOOP_CLR_FD) = 0 [pid 6199] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6199] close(5) = 0 [pid 6199] close(4) = 0 [pid 6199] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6198] <... futex resumed>) = 0 [pid 6198] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6199] <... futex resumed>) = 1 [pid 6199] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6198] <... futex resumed>) = 0 [pid 6199] <... openat resumed>) = 4 [pid 6198] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6199] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6198] <... futex resumed>) = 0 [pid 6198] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6198] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6199] <... futex resumed>) = 1 [pid 6199] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6199] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6198] <... futex resumed>) = 0 [pid 6198] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6198] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6199] <... futex resumed>) = 1 [pid 6199] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6199] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6198] <... futex resumed>) = 0 [pid 6198] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6199] <... futex resumed>) = 1 [pid 6198] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6199] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6199] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6199] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6198] <... futex resumed>) = 0 [ 130.329227][ T6199] loop0: detected capacity change from 0 to 64 [pid 6198] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6199] <... futex resumed>) = 1 [pid 6199] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6199] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6198] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6199] <... openat resumed>) = 6 [pid 6198] <... futex resumed>) = 0 [pid 6198] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6199] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6198] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6199] <... futex resumed>) = 0 [pid 6199] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6198] <... mprotect resumed>) = 0 [pid 6198] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6198] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6200 attached => {parent_tid=[6200]}, 88) = 6200 [pid 6200] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6198] rt_sigprocmask(SIG_SETMASK, [], [pid 6200] set_robust_list(0x7f6d360d69a0, 24 [pid 6198] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6200] <... set_robust_list resumed>) = 0 [pid 6198] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6200] rt_sigprocmask(SIG_SETMASK, [], [pid 6198] <... futex resumed>) = 0 [pid 6200] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6198] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6200] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6200] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6200] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6198] <... futex resumed>) = 0 [pid 6198] exit_group(0 [pid 6199] <... futex resumed>) = ? [pid 6200] <... futex resumed>) = ? [pid 6199] +++ exited with 0 +++ [pid 6200] +++ exited with 0 +++ [pid 6198] <... exit_group resumed>) = ? [pid 6198] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6198, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./384", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./384", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./384/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./384/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./384/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./384/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./384/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./384/bus") = 0 umount2("./384/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./384/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./384/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./384") = 0 mkdir("./385", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6201 attached , child_tidptr=0x5555564f6750) = 6201 [pid 6201] set_robust_list(0x5555564f6760, 24) = 0 [pid 6201] chdir("./385") = 0 [pid 6201] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6201] setpgid(0, 0) = 0 [pid 6201] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6201] write(3, "1000", 4) = 4 [pid 6201] close(3) = 0 [pid 6201] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6201] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6201] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6201] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6201] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6201] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6201] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6201] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6202 attached => {parent_tid=[6202]}, 88) = 6202 [pid 6202] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6201] rt_sigprocmask(SIG_SETMASK, [], [pid 6202] <... rseq resumed>) = 0 [pid 6201] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6202] set_robust_list(0x7f6d468e79a0, 24 [pid 6201] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6202] <... set_robust_list resumed>) = 0 [pid 6201] <... futex resumed>) = 0 [pid 6202] rt_sigprocmask(SIG_SETMASK, [], [pid 6201] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6202] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6202] memfd_create("syzkaller", 0) = 3 [pid 6202] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6202] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6202] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6202] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6202] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6202] close(3) = 0 [pid 6202] mkdir("./bus", 0777) = 0 [pid 6202] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6202] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6202] chdir("./bus") = 0 [pid 6202] ioctl(4, LOOP_CLR_FD) = 0 [pid 6202] close(4) = 0 [pid 6202] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6201] <... futex resumed>) = 0 [pid 6202] <... futex resumed>) = 1 [pid 6202] memfd_create("syzkaller", 0 [pid 6201] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6202] <... memfd_create resumed>) = 4 [pid 6201] <... futex resumed>) = 0 [pid 6202] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6201] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6202] <... mmap resumed>) = 0x7f6d360cf000 [pid 6202] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6202] munmap(0x7f6d360cf000, 32768) = 0 [pid 6202] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6202] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6202] ioctl(5, LOOP_CLR_FD) = 0 [pid 6202] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6202] close(5) = 0 [pid 6202] close(4) = 0 [pid 6202] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6202] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6201] <... futex resumed>) = 0 [pid 6201] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6202] <... futex resumed>) = 0 [pid 6202] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6202] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6201] <... futex resumed>) = 1 [pid 6202] <... futex resumed>) = 0 [pid 6201] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6202] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6201] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6202] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6201] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6202] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6201] <... futex resumed>) = 0 [pid 6201] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6202] <... write resumed>) = 12288 [pid 6202] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6201] <... futex resumed>) = 0 [pid 6201] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6201] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6202] <... futex resumed>) = 1 [pid 6202] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6202] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6201] <... futex resumed>) = 0 [pid 6202] <... futex resumed>) = 1 [pid 6202] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6201] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6202] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6201] <... futex resumed>) = 0 [pid 6202] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6201] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6202] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6202] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6201] <... futex resumed>) = 0 [pid 6202] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6201] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6202] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6201] <... futex resumed>) = 0 [pid 6202] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6201] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6202] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6201] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6202] <... openat resumed>) = 6 [pid 6201] <... mmap resumed>) = 0x7f6d360b6000 [pid 6201] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6202] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6201] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6202] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6201] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6201] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} => {parent_tid=[6203]}, 88) = 6203 ./strace-static-x86_64: Process 6203 attached [pid 6203] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6201] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6201] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6201] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6203] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6203] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6203] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6203] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6201] <... futex resumed>) = 0 [pid 6203] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6201] exit_group(0 [pid 6202] <... futex resumed>) = ? [pid 6203] <... futex resumed>) = ? [pid 6201] <... exit_group resumed>) = ? [pid 6203] +++ exited with 0 +++ [pid 6202] +++ exited with 0 +++ [pid 6201] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6201, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./385", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./385", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 [ 130.470561][ T6202] loop0: detected capacity change from 0 to 64 umount2("./385/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./385/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./385/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./385/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./385/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./385/bus") = 0 umount2("./385/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./385/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./385/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./385") = 0 mkdir("./386", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6204 attached , child_tidptr=0x5555564f6750) = 6204 [pid 6204] set_robust_list(0x5555564f6760, 24) = 0 [pid 6204] chdir("./386") = 0 [pid 6204] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6204] setpgid(0, 0) = 0 [pid 6204] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6204] write(3, "1000", 4) = 4 [pid 6204] close(3) = 0 [pid 6204] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6204] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6204] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6204] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6204] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6204] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6204] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6204] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6205 attached [pid 6205] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6204] <... clone3 resumed> => {parent_tid=[6205]}, 88) = 6205 [pid 6205] <... rseq resumed>) = 0 [pid 6204] rt_sigprocmask(SIG_SETMASK, [], [pid 6205] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6204] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6205] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6204] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6205] memfd_create("syzkaller", 0 [pid 6204] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6205] <... memfd_create resumed>) = 3 [pid 6205] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6205] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6205] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6205] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6205] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6205] close(3) = 0 [pid 6205] mkdir("./bus", 0777) = 0 [pid 6205] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6205] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6205] chdir("./bus") = 0 [pid 6205] ioctl(4, LOOP_CLR_FD) = 0 [pid 6205] close(4) = 0 [pid 6205] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6205] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6204] <... futex resumed>) = 0 [pid 6204] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6205] <... futex resumed>) = 0 [pid 6205] memfd_create("syzkaller", 0 [pid 6204] <... futex resumed>) = 1 [pid 6205] <... memfd_create resumed>) = 4 [pid 6204] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6205] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6205] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6205] munmap(0x7f6d360cf000, 32768) = 0 [pid 6205] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6205] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6205] ioctl(5, LOOP_CLR_FD) = 0 [pid 6205] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6205] close(5) = 0 [pid 6205] close(4) = 0 [pid 6205] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6204] <... futex resumed>) = 0 [pid 6204] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6205] <... futex resumed>) = 1 [pid 6205] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6204] <... futex resumed>) = 0 [pid 6205] <... openat resumed>) = 4 [pid 6204] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6205] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6204] <... futex resumed>) = 0 [pid 6204] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6204] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6205] <... futex resumed>) = 1 [pid 6205] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6205] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6204] <... futex resumed>) = 0 [pid 6204] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6204] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6205] <... futex resumed>) = 1 [pid 6205] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6205] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6204] <... futex resumed>) = 0 [pid 6205] <... futex resumed>) = 1 [pid 6204] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6205] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6204] <... futex resumed>) = 0 [pid 6205] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6204] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6205] <... openat resumed>) = 5 [pid 6205] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6204] <... futex resumed>) = 0 [pid 6204] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6204] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6205] <... futex resumed>) = 1 [pid 6204] <... futex resumed>) = 0 [pid 6204] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6205] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6204] <... mmap resumed>) = 0x7f6d360b6000 [pid 6205] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6204] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6205] <... openat resumed>) = 6 [pid 6204] <... mprotect resumed>) = 0 [pid 6204] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6204] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6205] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 6206 attached [pid 6205] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6206] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6204] <... clone3 resumed> => {parent_tid=[6206]}, 88) = 6206 [pid 6206] <... rseq resumed>) = 0 [pid 6204] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6204] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6206] set_robust_list(0x7f6d360d69a0, 24 [pid 6204] <... futex resumed>) = 0 [pid 6206] <... set_robust_list resumed>) = 0 [pid 6206] rt_sigprocmask(SIG_SETMASK, [], [pid 6204] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6206] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6206] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [ 130.593548][ T6205] loop0: detected capacity change from 0 to 64 [pid 6206] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6206] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6204] <... futex resumed>) = 0 [pid 6204] exit_group(0 [pid 6206] <... futex resumed>) = ? [pid 6206] +++ exited with 0 +++ [pid 6205] <... futex resumed>) = ? [pid 6205] +++ exited with 0 +++ [pid 6204] <... exit_group resumed>) = ? [pid 6204] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6204, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./386", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./386", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./386/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./386/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./386/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./386/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./386/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./386/bus") = 0 umount2("./386/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./386/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./386/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./386") = 0 mkdir("./387", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6207 ./strace-static-x86_64: Process 6207 attached [pid 6207] set_robust_list(0x5555564f6760, 24) = 0 [pid 6207] chdir("./387") = 0 [pid 6207] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6207] setpgid(0, 0) = 0 [pid 6207] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6207] write(3, "1000", 4) = 4 [pid 6207] close(3) = 0 [pid 6207] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6207] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6207] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6207] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6207] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6207] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6207] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6207] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6208 attached [pid 6208] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6207] <... clone3 resumed> => {parent_tid=[6208]}, 88) = 6208 [pid 6208] <... rseq resumed>) = 0 [pid 6208] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6207] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6207] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6207] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6208] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6208] memfd_create("syzkaller", 0) = 3 [pid 6208] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6208] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6208] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6208] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6208] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6208] close(3) = 0 [pid 6208] mkdir("./bus", 0777) = 0 [pid 6208] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6208] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6208] chdir("./bus") = 0 [pid 6208] ioctl(4, LOOP_CLR_FD) = 0 [pid 6208] close(4) = 0 [pid 6208] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6208] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6207] <... futex resumed>) = 0 [pid 6207] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6208] <... futex resumed>) = 0 [pid 6208] memfd_create("syzkaller", 0) = 4 [pid 6207] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6208] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6208] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6208] munmap(0x7f6d360cf000, 32768) = 0 [pid 6208] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6208] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6208] ioctl(5, LOOP_CLR_FD) = 0 [pid 6208] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6208] close(5) = 0 [pid 6208] close(4) = 0 [pid 6208] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6207] <... futex resumed>) = 0 [pid 6208] <... futex resumed>) = 1 [pid 6207] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6208] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6207] <... futex resumed>) = 0 [pid 6207] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6208] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6207] <... futex resumed>) = 0 [pid 6207] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6207] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6208] <... futex resumed>) = 1 [pid 6208] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6208] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6207] <... futex resumed>) = 0 [pid 6208] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6207] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6208] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6207] <... futex resumed>) = 0 [pid 6208] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6207] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6208] <... mmap resumed>) = 0x20000000 [pid 6208] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6207] <... futex resumed>) = 0 [pid 6207] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6208] <... futex resumed>) = 1 [pid 6207] <... futex resumed>) = 0 [pid 6208] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6207] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6208] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6208] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6207] <... futex resumed>) = 0 [pid 6208] <... futex resumed>) = 1 [pid 6208] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6207] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6208] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6207] <... futex resumed>) = 0 [pid 6208] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6207] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6208] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6207] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6208] <... openat resumed>) = 6 [pid 6207] <... mmap resumed>) = 0x7f6d360b6000 [pid 6207] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6208] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6207] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6208] <... futex resumed>) = 0 [pid 6208] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6207] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6207] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} => {parent_tid=[6209]}, 88) = 6209 [pid 6207] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6207] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 6209 attached ) = 0 [pid 6207] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6209] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6209] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6209] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6209] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [ 130.733735][ T6208] loop0: detected capacity change from 0 to 64 [pid 6209] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6207] <... futex resumed>) = 0 [pid 6207] exit_group(0 [pid 6208] <... futex resumed>) = ? [pid 6207] <... exit_group resumed>) = ? [pid 6208] +++ exited with 0 +++ [pid 6209] +++ exited with 0 +++ [pid 6207] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6207, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./387", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./387", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./387/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./387/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./387/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./387/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./387/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./387/bus") = 0 umount2("./387/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./387/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./387/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./387") = 0 mkdir("./388", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6210 attached , child_tidptr=0x5555564f6750) = 6210 [pid 6210] set_robust_list(0x5555564f6760, 24) = 0 [pid 6210] chdir("./388") = 0 [pid 6210] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6210] setpgid(0, 0) = 0 [pid 6210] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6210] write(3, "1000", 4) = 4 [pid 6210] close(3) = 0 [pid 6210] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6210] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6210] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6210] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6210] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6210] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6210] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6210] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0} => {parent_tid=[6211]}, 88) = 6211 ./strace-static-x86_64: Process 6211 attached [pid 6211] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6210] rt_sigprocmask(SIG_SETMASK, [], [pid 6211] <... rseq resumed>) = 0 [pid 6211] set_robust_list(0x7f6d468e79a0, 24 [pid 6210] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6211] <... set_robust_list resumed>) = 0 [pid 6211] rt_sigprocmask(SIG_SETMASK, [], [pid 6210] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6211] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6210] <... futex resumed>) = 0 [pid 6210] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6211] memfd_create("syzkaller", 0) = 3 [pid 6211] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6211] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6211] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6211] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6211] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6211] close(3) = 0 [pid 6211] mkdir("./bus", 0777) = 0 [pid 6211] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6211] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6211] chdir("./bus") = 0 [pid 6211] ioctl(4, LOOP_CLR_FD) = 0 [pid 6211] close(4) = 0 [pid 6211] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6211] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6210] <... futex resumed>) = 0 [pid 6210] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6211] <... futex resumed>) = 0 [pid 6211] memfd_create("syzkaller", 0) = 4 [pid 6211] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6211] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6211] munmap(0x7f6d360cf000, 32768) = 0 [pid 6211] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6211] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6211] ioctl(5, LOOP_CLR_FD) = 0 [pid 6210] <... futex resumed>) = 1 [pid 6210] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6211] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6211] close(5) = 0 [pid 6211] close(4) = 0 [pid 6211] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6211] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6210] <... futex resumed>) = 0 [pid 6211] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6210] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6211] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6210] <... futex resumed>) = 0 [pid 6211] <... openat resumed>) = 4 [pid 6210] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6211] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6211] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6210] <... futex resumed>) = 0 [pid 6210] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6211] <... futex resumed>) = 0 [pid 6210] <... futex resumed>) = 1 [pid 6211] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6210] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6211] <... write resumed>) = 12288 [pid 6211] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6210] <... futex resumed>) = 0 [pid 6211] <... futex resumed>) = 1 [pid 6210] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6211] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6210] <... futex resumed>) = 0 [ 130.859883][ T6211] loop0: detected capacity change from 0 to 64 [pid 6211] <... mmap resumed>) = 0x20000000 [pid 6210] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6211] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6210] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6211] <... futex resumed>) = 0 [pid 6211] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6210] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6211] <... futex resumed>) = 0 [pid 6211] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6210] <... futex resumed>) = 1 [pid 6211] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6210] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6211] <... openat resumed>) = 5 [pid 6211] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6210] <... futex resumed>) = 0 [pid 6211] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6210] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6211] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6210] <... futex resumed>) = 0 [pid 6211] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6211] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6210] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6210] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6210] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6211] <... openat resumed>) = 6 [pid 6210] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6211] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6210] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6211] <... futex resumed>) = 0 [pid 6210] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6211] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 6212 attached [pid 6210] <... clone3 resumed> => {parent_tid=[6212]}, 88) = 6212 [pid 6210] rt_sigprocmask(SIG_SETMASK, [], [pid 6212] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6212] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6210] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6212] rt_sigprocmask(SIG_SETMASK, [], [pid 6210] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6212] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6210] <... futex resumed>) = 0 [pid 6210] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6212] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6212] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6210] <... futex resumed>) = 0 [pid 6210] exit_group(0 [pid 6212] <... futex resumed>) = 1 [pid 6212] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL) = ? [pid 6210] <... exit_group resumed>) = ? [pid 6212] +++ exited with 0 +++ [pid 6211] <... futex resumed>) = ? [pid 6211] +++ exited with 0 +++ [pid 6210] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6210, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./388", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./388", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./388/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./388/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./388/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./388/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./388/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./388/bus") = 0 umount2("./388/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./388/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./388/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./388") = 0 mkdir("./389", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6213 attached , child_tidptr=0x5555564f6750) = 6213 [pid 6213] set_robust_list(0x5555564f6760, 24) = 0 [pid 6213] chdir("./389") = 0 [pid 6213] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6213] setpgid(0, 0) = 0 [pid 6213] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6213] write(3, "1000", 4) = 4 [pid 6213] close(3) = 0 [pid 6213] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6213] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6213] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6213] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6213] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6213] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6213] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6213] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6214 attached [pid 6214] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6213] <... clone3 resumed> => {parent_tid=[6214]}, 88) = 6214 [pid 6214] set_robust_list(0x7f6d468e79a0, 24 [pid 6213] rt_sigprocmask(SIG_SETMASK, [], [pid 6214] <... set_robust_list resumed>) = 0 [pid 6214] rt_sigprocmask(SIG_SETMASK, [], [pid 6213] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6214] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6213] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6214] memfd_create("syzkaller", 0 [pid 6213] <... futex resumed>) = 0 [pid 6213] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6214] <... memfd_create resumed>) = 3 [pid 6214] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6214] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6214] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6214] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6214] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6214] close(3) = 0 [pid 6214] mkdir("./bus", 0777) = 0 [pid 6214] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6214] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6214] chdir("./bus") = 0 [pid 6214] ioctl(4, LOOP_CLR_FD) = 0 [pid 6214] close(4) = 0 [pid 6214] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6213] <... futex resumed>) = 0 [pid 6214] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6213] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6214] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6213] <... futex resumed>) = 0 [pid 6214] memfd_create("syzkaller", 0) = 4 [pid 6213] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6214] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6214] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6214] munmap(0x7f6d360cf000, 32768) = 0 [pid 6214] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6214] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6214] ioctl(5, LOOP_CLR_FD) = 0 [pid 6214] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6214] close(5) = 0 [pid 6214] close(4) = 0 [pid 6214] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6213] <... futex resumed>) = 0 [pid 6214] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6213] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6214] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6213] <... futex resumed>) = 0 [pid 6214] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6213] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6214] <... openat resumed>) = 4 [pid 6214] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6213] <... futex resumed>) = 0 [pid 6214] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6213] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6214] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6213] <... futex resumed>) = 0 [pid 6213] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6214] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6214] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6213] <... futex resumed>) = 0 [pid 6214] <... futex resumed>) = 1 [pid 6213] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6214] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6213] <... futex resumed>) = 0 [pid 6214] <... mmap resumed>) = 0x20000000 [pid 6213] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6214] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6213] <... futex resumed>) = 0 [pid 6213] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6214] <... futex resumed>) = 1 [pid 6214] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6213] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6214] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6214] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6213] <... futex resumed>) = 0 [pid 6213] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6214] <... futex resumed>) = 1 [pid 6213] <... futex resumed>) = 0 [pid 6214] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6213] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6214] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6213] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6214] <... openat resumed>) = 6 [pid 6213] <... mmap resumed>) = 0x7f6d360b6000 [pid 6213] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6214] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6213] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6214] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6213] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6213] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6215 attached => {parent_tid=[6215]}, 88) = 6215 [pid 6213] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6213] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6213] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6215] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6215] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6215] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 130.992897][ T6214] loop0: detected capacity change from 0 to 64 [pid 6215] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6215] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6213] <... futex resumed>) = 0 [pid 6215] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6213] exit_group(0 [pid 6214] <... futex resumed>) = ? [pid 6215] <... futex resumed>) = ? [pid 6213] <... exit_group resumed>) = ? [pid 6215] +++ exited with 0 +++ [pid 6214] +++ exited with 0 +++ [pid 6213] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6213, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./389", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./389", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./389/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./389/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./389/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./389/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./389/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./389/bus") = 0 umount2("./389/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./389/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./389/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./389") = 0 mkdir("./390", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6216 attached , child_tidptr=0x5555564f6750) = 6216 [pid 6216] set_robust_list(0x5555564f6760, 24) = 0 [pid 6216] chdir("./390") = 0 [pid 6216] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6216] setpgid(0, 0) = 0 [pid 6216] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6216] write(3, "1000", 4) = 4 [pid 6216] close(3) = 0 [pid 6216] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6216] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6216] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6216] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6216] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6216] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6216] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6216] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6217 attached => {parent_tid=[6217]}, 88) = 6217 [pid 6217] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6216] rt_sigprocmask(SIG_SETMASK, [], [pid 6217] <... rseq resumed>) = 0 [pid 6217] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6216] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6216] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6217] rt_sigprocmask(SIG_SETMASK, [], [pid 6216] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6217] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6217] memfd_create("syzkaller", 0) = 3 [pid 6217] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6217] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6217] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6217] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6217] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6217] close(3) = 0 [pid 6217] mkdir("./bus", 0777) = 0 [pid 6217] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6217] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6217] chdir("./bus") = 0 [pid 6217] ioctl(4, LOOP_CLR_FD) = 0 [pid 6217] close(4) = 0 [pid 6217] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6217] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6216] <... futex resumed>) = 0 [pid 6216] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6217] <... futex resumed>) = 0 [pid 6217] memfd_create("syzkaller", 0) = 4 [pid 6217] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6216] <... futex resumed>) = 1 [pid 6217] <... mmap resumed>) = 0x7f6d360cf000 [pid 6216] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6217] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6217] munmap(0x7f6d360cf000, 32768) = 0 [pid 6217] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6217] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6217] ioctl(5, LOOP_CLR_FD) = 0 [pid 6217] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6217] close(5) = 0 [pid 6217] close(4) = 0 [pid 6217] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6216] <... futex resumed>) = 0 [pid 6217] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6216] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6217] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6216] <... futex resumed>) = 0 [pid 6217] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6216] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6217] <... openat resumed>) = 4 [pid 6217] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6216] <... futex resumed>) = 0 [pid 6217] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6216] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6217] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6216] <... futex resumed>) = 0 [pid 6217] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6216] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6217] <... write resumed>) = 12288 [pid 6217] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6216] <... futex resumed>) = 0 [pid 6216] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6217] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6216] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6217] <... mmap resumed>) = 0x20000000 [pid 6217] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6216] <... futex resumed>) = 0 [pid 6217] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6216] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6217] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6216] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6217] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6217] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [ 131.124778][ T6217] loop0: detected capacity change from 0 to 64 [pid 6217] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6216] <... futex resumed>) = 0 [pid 6217] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6216] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6217] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6216] <... futex resumed>) = 0 [pid 6217] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6216] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6217] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6216] <... futex resumed>) = 0 [pid 6216] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6216] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6216] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6216] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6218 attached [pid 6218] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6216] <... clone3 resumed> => {parent_tid=[6218]}, 88) = 6218 [pid 6218] <... rseq resumed>) = 0 [pid 6216] rt_sigprocmask(SIG_SETMASK, [], [pid 6218] set_robust_list(0x7f6d360d69a0, 24 [pid 6216] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6218] <... set_robust_list resumed>) = 0 [pid 6216] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6218] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6216] <... futex resumed>) = 0 [pid 6218] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6216] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6218] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6217] <... openat resumed>) = 6 [pid 6216] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6217] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6218] <... futex resumed>) = 0 [pid 6216] exit_group(0 [pid 6217] <... futex resumed>) = ? [pid 6216] <... exit_group resumed>) = ? [pid 6217] +++ exited with 0 +++ [pid 6218] +++ exited with 0 +++ [pid 6216] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6216, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./390", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./390", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./390/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./390/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./390/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./390/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./390/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./390/bus") = 0 umount2("./390/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./390/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./390/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./390") = 0 mkdir("./391", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6219 attached , child_tidptr=0x5555564f6750) = 6219 [pid 6219] set_robust_list(0x5555564f6760, 24) = 0 [pid 6219] chdir("./391") = 0 [pid 6219] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6219] setpgid(0, 0) = 0 [pid 6219] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6219] write(3, "1000", 4) = 4 [pid 6219] close(3) = 0 [pid 6219] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6219] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6219] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6219] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6219] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6219] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6219] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6219] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6220 attached [pid 6220] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6219] <... clone3 resumed> => {parent_tid=[6220]}, 88) = 6220 [pid 6220] set_robust_list(0x7f6d468e79a0, 24 [pid 6219] rt_sigprocmask(SIG_SETMASK, [], [pid 6220] <... set_robust_list resumed>) = 0 [pid 6219] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6220] rt_sigprocmask(SIG_SETMASK, [], [pid 6219] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6220] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6219] <... futex resumed>) = 0 [pid 6220] memfd_create("syzkaller", 0 [pid 6219] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6220] <... memfd_create resumed>) = 3 [pid 6220] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6220] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6220] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6220] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6220] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6220] close(3) = 0 [pid 6220] mkdir("./bus", 0777) = 0 [pid 6220] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6220] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6220] chdir("./bus") = 0 [pid 6220] ioctl(4, LOOP_CLR_FD) = 0 [pid 6220] close(4) = 0 [pid 6220] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6219] <... futex resumed>) = 0 [pid 6220] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6219] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6220] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6219] <... futex resumed>) = 0 [pid 6220] memfd_create("syzkaller", 0 [pid 6219] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6220] <... memfd_create resumed>) = 4 [pid 6220] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6220] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6220] munmap(0x7f6d360cf000, 32768) = 0 [pid 6220] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6220] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6220] ioctl(5, LOOP_CLR_FD) = 0 [pid 6220] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6220] close(5) = 0 [pid 6220] close(4) = 0 [pid 6220] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6219] <... futex resumed>) = 0 [pid 6220] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6219] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6220] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6219] <... futex resumed>) = 0 [pid 6219] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6220] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6220] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6219] <... futex resumed>) = 0 [pid 6220] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6219] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6220] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6220] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6219] <... futex resumed>) = 0 [pid 6219] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6220] <... write resumed>) = 12288 [pid 6220] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6219] <... futex resumed>) = 0 [pid 6220] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6219] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6220] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6219] <... futex resumed>) = 0 [pid 6220] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6219] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6220] <... mmap resumed>) = 0x20000000 [pid 6220] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6220] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6219] <... futex resumed>) = 0 [pid 6219] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6219] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6220] <... futex resumed>) = 0 [pid 6220] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6220] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6220] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6220] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6219] <... futex resumed>) = 0 [pid 6219] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6220] <... futex resumed>) = 0 [pid 6220] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6219] <... futex resumed>) = 1 [pid 6220] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6219] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6220] <... openat resumed>) = 6 [pid 6219] <... futex resumed>) = 0 [pid 6220] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6219] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6220] <... futex resumed>) = 0 [pid 6220] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6219] <... mmap resumed>) = 0x7f6d360b6000 [ 131.232205][ T6220] loop0: detected capacity change from 0 to 64 [pid 6219] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6219] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6219] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6221 attached => {parent_tid=[6221]}, 88) = 6221 [pid 6221] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6219] rt_sigprocmask(SIG_SETMASK, [], [pid 6221] set_robust_list(0x7f6d360d69a0, 24 [pid 6219] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6221] <... set_robust_list resumed>) = 0 [pid 6219] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6221] rt_sigprocmask(SIG_SETMASK, [], [pid 6219] <... futex resumed>) = 0 [pid 6221] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6219] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6221] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6221] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6219] <... futex resumed>) = 0 [pid 6221] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6219] exit_group(0 [pid 6221] <... futex resumed>) = ? [pid 6219] <... exit_group resumed>) = ? [pid 6221] +++ exited with 0 +++ [pid 6220] <... futex resumed>) = ? [pid 6220] +++ exited with 0 +++ [pid 6219] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6219, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./391", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./391", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./391/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./391/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./391/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./391/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./391/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./391/bus") = 0 umount2("./391/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./391/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./391/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./391") = 0 mkdir("./392", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6222 attached , child_tidptr=0x5555564f6750) = 6222 [pid 6222] set_robust_list(0x5555564f6760, 24) = 0 [pid 6222] chdir("./392") = 0 [pid 6222] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6222] setpgid(0, 0) = 0 [pid 6222] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6222] write(3, "1000", 4) = 4 [pid 6222] close(3) = 0 [pid 6222] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6222] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6222] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6222] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6222] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6222] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6222] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6222] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0} => {parent_tid=[6223]}, 88) = 6223 [pid 6222] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6222] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6222] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 6223 attached [pid 6223] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6223] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6223] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6223] memfd_create("syzkaller", 0) = 3 [pid 6223] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6223] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6223] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6223] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6223] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6223] close(3) = 0 [pid 6223] mkdir("./bus", 0777) = 0 [pid 6223] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6223] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6223] chdir("./bus") = 0 [pid 6223] ioctl(4, LOOP_CLR_FD) = 0 [pid 6223] close(4) = 0 [pid 6223] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6222] <... futex resumed>) = 0 [pid 6223] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6222] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6223] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6222] <... futex resumed>) = 0 [pid 6223] memfd_create("syzkaller", 0 [pid 6222] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6223] <... memfd_create resumed>) = 4 [pid 6223] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6223] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6223] munmap(0x7f6d360cf000, 32768) = 0 [pid 6223] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6223] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6223] ioctl(5, LOOP_CLR_FD) = 0 [pid 6223] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6223] close(5) = 0 [pid 6223] close(4) = 0 [pid 6223] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6222] <... futex resumed>) = 0 [pid 6223] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6222] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6223] <... openat resumed>) = 4 [pid 6222] <... futex resumed>) = 0 [pid 6222] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6223] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6222] <... futex resumed>) = 0 [pid 6222] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6222] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6223] <... futex resumed>) = 1 [pid 6223] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6223] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6222] <... futex resumed>) = 0 [pid 6222] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6222] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6223] <... futex resumed>) = 1 [pid 6223] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6223] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6222] <... futex resumed>) = 0 [pid 6223] <... futex resumed>) = 1 [pid 6222] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6223] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6222] <... futex resumed>) = 0 [pid 6223] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6222] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6223] <... openat resumed>) = 5 [pid 6223] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6222] <... futex resumed>) = 0 [pid 6222] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6222] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6222] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6223] <... futex resumed>) = 1 [pid 6223] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6222] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6223] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [pid 6222] <... mprotect resumed>) = 0 [pid 6222] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6223] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6222] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6223] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6222] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6224 attached [pid 6224] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6222] <... clone3 resumed> => {parent_tid=[6224]}, 88) = 6224 [pid 6224] <... rseq resumed>) = 0 [pid 6222] rt_sigprocmask(SIG_SETMASK, [], [pid 6224] set_robust_list(0x7f6d360d69a0, 24 [pid 6222] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6224] <... set_robust_list resumed>) = 0 [pid 6222] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6224] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6222] <... futex resumed>) = 0 [pid 6224] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6222] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6224] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6224] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6222] <... futex resumed>) = 0 [pid 6222] exit_group(0) = ? [pid 6223] <... futex resumed>) = ? [pid 6224] <... futex resumed>) = ? [pid 6223] +++ exited with 0 +++ [pid 6224] +++ exited with 0 +++ [pid 6222] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6222, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./392", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./392", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 131.352725][ T6223] loop0: detected capacity change from 0 to 64 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./392/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./392/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./392/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./392/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./392/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./392/bus") = 0 umount2("./392/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./392/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./392/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./392") = 0 mkdir("./393", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6225 attached , child_tidptr=0x5555564f6750) = 6225 [pid 6225] set_robust_list(0x5555564f6760, 24) = 0 [pid 6225] chdir("./393") = 0 [pid 6225] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6225] setpgid(0, 0) = 0 [pid 6225] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6225] write(3, "1000", 4) = 4 [pid 6225] close(3) = 0 [pid 6225] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6225] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6225] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6225] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6225] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6225] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6225] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6225] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6226 attached [pid 6226] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6225] <... clone3 resumed> => {parent_tid=[6226]}, 88) = 6226 [pid 6226] <... rseq resumed>) = 0 [pid 6225] rt_sigprocmask(SIG_SETMASK, [], [pid 6226] set_robust_list(0x7f6d468e79a0, 24 [pid 6225] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6226] <... set_robust_list resumed>) = 0 [pid 6225] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6226] rt_sigprocmask(SIG_SETMASK, [], [pid 6225] <... futex resumed>) = 0 [pid 6226] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6225] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6226] memfd_create("syzkaller", 0) = 3 [pid 6226] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6226] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6226] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6226] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6226] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6226] close(3) = 0 [pid 6226] mkdir("./bus", 0777) = 0 [pid 6226] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6226] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6226] chdir("./bus") = 0 [pid 6226] ioctl(4, LOOP_CLR_FD) = 0 [pid 6226] close(4) = 0 [pid 6226] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6225] <... futex resumed>) = 0 [pid 6225] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6225] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6226] memfd_create("syzkaller", 0) = 4 [pid 6226] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6226] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6226] munmap(0x7f6d360cf000, 32768) = 0 [pid 6226] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6226] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6226] ioctl(5, LOOP_CLR_FD) = 0 [pid 6226] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6226] close(5) = 0 [pid 6226] close(4) = 0 [pid 6226] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6226] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6225] <... futex resumed>) = 0 [pid 6225] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6226] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6226] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6226] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6226] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6225] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 6225] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6225] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6226] <... futex resumed>) = 0 [pid 6226] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6226] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6225] <... futex resumed>) = 0 [pid 6225] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6225] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6226] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6226] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6225] <... futex resumed>) = 0 [pid 6225] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6225] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6226] <... futex resumed>) = 1 [pid 6226] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6226] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6226] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6225] <... futex resumed>) = 0 [pid 6225] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6225] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6225] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6225] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6225] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6225] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} => {parent_tid=[6227]}, 88) = 6227 ./strace-static-x86_64: Process 6227 attached [pid 6225] rt_sigprocmask(SIG_SETMASK, [], [pid 6227] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6226] <... futex resumed>) = 1 [pid 6225] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6227] <... rseq resumed>) = 0 [pid 6226] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6225] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6227] set_robust_list(0x7f6d360d69a0, 24 [pid 6225] <... futex resumed>) = 0 [pid 6227] <... set_robust_list resumed>) = 0 [pid 6226] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6225] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6227] rt_sigprocmask(SIG_SETMASK, [], [pid 6226] <... openat resumed>) = 6 [pid 6227] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6227] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6226] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6226] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6227] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6225] <... futex resumed>) = 0 [ 131.492899][ T6226] loop0: detected capacity change from 0 to 64 [pid 6227] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6225] exit_group(0 [pid 6227] <... futex resumed>) = ? [pid 6226] <... futex resumed>) = ? [pid 6225] <... exit_group resumed>) = ? [pid 6227] +++ exited with 0 +++ [pid 6226] +++ exited with 0 +++ [pid 6225] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6225, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./393", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./393", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./393/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./393/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./393/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./393/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./393/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./393/bus") = 0 umount2("./393/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./393/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./393/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./393") = 0 mkdir("./394", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6228 attached [pid 6228] set_robust_list(0x5555564f6760, 24) = 0 [pid 6228] chdir("./394") = 0 [pid 6228] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6228] setpgid(0, 0) = 0 [pid 6228] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6228] write(3, "1000", 4) = 4 [pid 6228] close(3) = 0 [pid 6228] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6228] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6228] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6228] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6228] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6228] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6228] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6228] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6229 attached => {parent_tid=[6229]}, 88) = 6229 [pid 6229] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6228] rt_sigprocmask(SIG_SETMASK, [], [pid 6229] set_robust_list(0x7f6d468e79a0, 24 [pid 6228] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6229] <... set_robust_list resumed>) = 0 [pid 6228] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6229] rt_sigprocmask(SIG_SETMASK, [], [pid 6228] <... futex resumed>) = 0 [pid 6229] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6228] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6229] memfd_create("syzkaller", 0) = 3 [pid 6229] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6229] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6229] munmap(0x7f6d3e4c7000, 32768 [pid 5037] <... clone resumed>, child_tidptr=0x5555564f6750) = 6228 [pid 6229] <... munmap resumed>) = 0 [pid 6229] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6229] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6229] close(3) = 0 [pid 6229] mkdir("./bus", 0777) = 0 [pid 6229] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6229] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6229] chdir("./bus") = 0 [pid 6229] ioctl(4, LOOP_CLR_FD) = 0 [pid 6229] close(4) = 0 [pid 6229] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6228] <... futex resumed>) = 0 [pid 6229] <... futex resumed>) = 1 [pid 6228] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6229] memfd_create("syzkaller", 0 [pid 6228] <... futex resumed>) = 0 [pid 6229] <... memfd_create resumed>) = 4 [pid 6228] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6229] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6229] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6229] munmap(0x7f6d360cf000, 32768) = 0 [pid 6229] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6229] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6229] ioctl(5, LOOP_CLR_FD) = 0 [pid 6229] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6229] close(5) = 0 [pid 6229] close(4) = 0 [pid 6229] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6228] <... futex resumed>) = 0 [pid 6228] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6229] <... futex resumed>) = 1 [pid 6228] <... futex resumed>) = 0 [pid 6229] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6228] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6229] <... openat resumed>) = 4 [pid 6229] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6228] <... futex resumed>) = 0 [pid 6228] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6228] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6229] <... futex resumed>) = 1 [pid 6229] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6229] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6228] <... futex resumed>) = 0 [pid 6228] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6228] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6229] <... futex resumed>) = 1 [pid 6229] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6229] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6228] <... futex resumed>) = 0 [pid 6228] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6229] <... futex resumed>) = 1 [pid 6228] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6229] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6229] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6229] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6228] <... futex resumed>) = 0 [pid 6228] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6229] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6229] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6228] <... futex resumed>) = 0 [pid 6229] <... openat resumed>) = 6 [pid 6228] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6228] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6229] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6228] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6229] <... futex resumed>) = 0 [pid 6228] <... mprotect resumed>) = 0 [pid 6229] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6228] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6228] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6230 attached => {parent_tid=[6230]}, 88) = 6230 [pid 6230] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6228] rt_sigprocmask(SIG_SETMASK, [], [pid 6230] <... rseq resumed>) = 0 [pid 6230] set_robust_list(0x7f6d360d69a0, 24 [pid 6228] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6230] <... set_robust_list resumed>) = 0 [pid 6228] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6230] rt_sigprocmask(SIG_SETMASK, [], [pid 6228] <... futex resumed>) = 0 [pid 6230] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6228] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6230] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6230] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6228] <... futex resumed>) = 0 [ 131.618636][ T6229] loop0: detected capacity change from 0 to 64 [pid 6230] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6228] exit_group(0 [pid 6229] <... futex resumed>) = ? [pid 6230] <... futex resumed>) = ? [pid 6229] +++ exited with 0 +++ [pid 6230] +++ exited with 0 +++ [pid 6228] <... exit_group resumed>) = ? [pid 6228] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6228, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./394", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./394", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./394/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./394/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./394/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./394/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./394/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./394/bus") = 0 umount2("./394/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./394/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./394/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./394") = 0 mkdir("./395", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6231 attached , child_tidptr=0x5555564f6750) = 6231 [pid 6231] set_robust_list(0x5555564f6760, 24) = 0 [pid 6231] chdir("./395") = 0 [pid 6231] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6231] setpgid(0, 0) = 0 [pid 6231] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6231] write(3, "1000", 4) = 4 [pid 6231] close(3) = 0 [pid 6231] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6231] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6231] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6231] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6231] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6231] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6231] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6231] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6232 attached [pid 6232] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6231] <... clone3 resumed> => {parent_tid=[6232]}, 88) = 6232 [pid 6232] set_robust_list(0x7f6d468e79a0, 24 [pid 6231] rt_sigprocmask(SIG_SETMASK, [], [pid 6232] <... set_robust_list resumed>) = 0 [pid 6231] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6232] rt_sigprocmask(SIG_SETMASK, [], [pid 6231] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6232] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6231] <... futex resumed>) = 0 [pid 6232] memfd_create("syzkaller", 0 [pid 6231] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6232] <... memfd_create resumed>) = 3 [pid 6232] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6232] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6232] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6232] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6232] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6232] close(3) = 0 [pid 6232] mkdir("./bus", 0777) = 0 [pid 6232] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6232] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6232] chdir("./bus") = 0 [pid 6232] ioctl(4, LOOP_CLR_FD) = 0 [pid 6232] close(4) = 0 [pid 6232] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6231] <... futex resumed>) = 0 [pid 6231] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6232] memfd_create("syzkaller", 0 [pid 6231] <... futex resumed>) = 0 [pid 6232] <... memfd_create resumed>) = 4 [pid 6231] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6232] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6232] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6232] munmap(0x7f6d360cf000, 32768) = 0 [pid 6232] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6232] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6232] ioctl(5, LOOP_CLR_FD) = 0 [pid 6232] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6232] close(5) = 0 [pid 6232] close(4) = 0 [pid 6232] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6231] <... futex resumed>) = 0 [pid 6231] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6232] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6231] <... futex resumed>) = 0 [pid 6232] <... openat resumed>) = 4 [pid 6231] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6232] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6231] <... futex resumed>) = 0 [pid 6232] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6231] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6232] <... write resumed>) = 12288 [pid 6231] <... futex resumed>) = 0 [pid 6231] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 131.750624][ T6232] loop0: detected capacity change from 0 to 64 [pid 6232] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6231] <... futex resumed>) = 0 [pid 6231] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6232] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6231] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6232] <... mmap resumed>) = 0x20000000 [pid 6232] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6232] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6231] <... futex resumed>) = 0 [pid 6231] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6232] <... futex resumed>) = 0 [pid 6231] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6232] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6232] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6232] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6231] <... futex resumed>) = 0 [pid 6232] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6231] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6232] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6231] <... futex resumed>) = 0 [pid 6232] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6231] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6232] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6231] <... futex resumed>) = 0 [pid 6231] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6232] <... openat resumed>) = 6 [pid 6231] <... mmap resumed>) = 0x7f6d360b6000 [pid 6232] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6231] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6232] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6231] <... mprotect resumed>) = 0 [pid 6231] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6231] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6233 attached [pid 6233] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6231] <... clone3 resumed> => {parent_tid=[6233]}, 88) = 6233 [pid 6233] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6231] rt_sigprocmask(SIG_SETMASK, [], [pid 6233] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6231] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6233] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6231] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6233] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6231] <... futex resumed>) = 0 [pid 6233] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6231] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6233] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6233] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6231] <... futex resumed>) = 0 [pid 6233] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6231] exit_group(0 [pid 6233] <... futex resumed>) = ? [pid 6232] <... futex resumed>) = ? [pid 6231] <... exit_group resumed>) = ? [pid 6233] +++ exited with 0 +++ [pid 6232] +++ exited with 0 +++ [pid 6231] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6231, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./395", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./395", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./395/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./395/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./395/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./395/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./395/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./395/bus") = 0 umount2("./395/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./395/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./395/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./395") = 0 mkdir("./396", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6234 attached , child_tidptr=0x5555564f6750) = 6234 [pid 6234] set_robust_list(0x5555564f6760, 24) = 0 [pid 6234] chdir("./396") = 0 [pid 6234] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6234] setpgid(0, 0) = 0 [pid 6234] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6234] write(3, "1000", 4) = 4 [pid 6234] close(3) = 0 [pid 6234] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6234] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6234] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6234] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6234] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6234] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6234] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6234] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6235 attached [pid 6235] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6235] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6235] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6234] <... clone3 resumed> => {parent_tid=[6235]}, 88) = 6235 [pid 6235] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6234] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6234] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6235] <... futex resumed>) = 0 [pid 6234] <... futex resumed>) = 1 [pid 6235] memfd_create("syzkaller", 0 [pid 6234] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6235] <... memfd_create resumed>) = 3 [pid 6235] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6235] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6235] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6235] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6235] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6235] close(3) = 0 [pid 6235] mkdir("./bus", 0777) = 0 [pid 6235] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6235] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6235] chdir("./bus") = 0 [pid 6235] ioctl(4, LOOP_CLR_FD) = 0 [pid 6235] close(4) = 0 [pid 6235] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6235] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6234] <... futex resumed>) = 0 [pid 6235] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6234] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6235] memfd_create("syzkaller", 0) = 4 [pid 6234] <... futex resumed>) = 0 [pid 6234] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6235] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6235] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6235] munmap(0x7f6d360cf000, 32768) = 0 [pid 6235] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6235] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6235] ioctl(5, LOOP_CLR_FD) = 0 [pid 6235] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6235] close(5) = 0 [pid 6235] close(4) = 0 [pid 6235] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6234] <... futex resumed>) = 0 [pid 6235] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6234] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6235] <... openat resumed>) = 4 [pid 6234] <... futex resumed>) = 0 [pid 6234] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6235] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6234] <... futex resumed>) = 0 [pid 6234] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6234] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6235] <... futex resumed>) = 1 [pid 6235] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6235] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6234] <... futex resumed>) = 0 [pid 6234] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6234] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6235] <... futex resumed>) = 1 [pid 6235] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6235] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6234] <... futex resumed>) = 0 [pid 6235] <... futex resumed>) = 1 [pid 6234] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6235] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6235] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6234] <... futex resumed>) = 0 [pid 6235] <... openat resumed>) = 5 [pid 6234] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6235] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6234] <... futex resumed>) = 0 [pid 6234] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6234] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6234] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6235] <... futex resumed>) = 1 [pid 6234] <... mmap resumed>) = 0x7f6d360b6000 [pid 6235] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6235] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6234] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6235] <... openat resumed>) = 6 [pid 6234] <... mprotect resumed>) = 0 [pid 6234] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6234] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6235] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 6236 attached ) = 0 [pid 6236] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6235] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6234] <... clone3 resumed> => {parent_tid=[6236]}, 88) = 6236 [pid 6236] set_robust_list(0x7f6d360d69a0, 24 [pid 6234] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6236] <... set_robust_list resumed>) = 0 [pid 6234] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6236] rt_sigprocmask(SIG_SETMASK, [], [pid 6234] <... futex resumed>) = 0 [pid 6236] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6236] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [ 131.902713][ T6235] loop0: detected capacity change from 0 to 64 [pid 6234] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6236] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6236] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6234] <... futex resumed>) = 0 [pid 6236] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6234] exit_group(0 [pid 6236] <... futex resumed>) = ? [pid 6235] <... futex resumed>) = ? [pid 6234] <... exit_group resumed>) = ? [pid 6236] +++ exited with 0 +++ [pid 6235] +++ exited with 0 +++ [pid 6234] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6234, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- umount2("./396", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./396", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./396/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./396/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./396/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./396/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./396/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./396/bus") = 0 umount2("./396/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./396/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./396/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./396") = 0 mkdir("./397", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6237 attached [pid 6237] set_robust_list(0x5555564f6760, 24) = 0 [pid 5037] <... clone resumed>, child_tidptr=0x5555564f6750) = 6237 [pid 6237] chdir("./397") = 0 [pid 6237] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6237] setpgid(0, 0) = 0 [pid 6237] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6237] write(3, "1000", 4) = 4 [pid 6237] close(3) = 0 [pid 6237] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6237] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6237] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6237] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6237] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6237] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6237] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6237] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6238 attached [pid 6238] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6238] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6238] rt_sigprocmask(SIG_SETMASK, [], [pid 6237] <... clone3 resumed> => {parent_tid=[6238]}, 88) = 6238 [pid 6237] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6238] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6238] memfd_create("syzkaller", 0 [pid 6237] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6238] <... memfd_create resumed>) = 3 [pid 6238] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 6237] <... futex resumed>) = 0 [pid 6238] <... mmap resumed>) = 0x7f6d3e4c7000 [pid 6237] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6238] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6238] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6238] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6238] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6238] close(3) = 0 [pid 6238] mkdir("./bus", 0777) = 0 [pid 6238] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6238] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6238] chdir("./bus") = 0 [pid 6238] ioctl(4, LOOP_CLR_FD) = 0 [pid 6238] close(4) = 0 [pid 6238] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6237] <... futex resumed>) = 0 [pid 6238] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6237] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6238] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6237] <... futex resumed>) = 0 [pid 6238] memfd_create("syzkaller", 0 [pid 6237] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6238] <... memfd_create resumed>) = 4 [pid 6238] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6238] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6238] munmap(0x7f6d360cf000, 32768) = 0 [pid 6238] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6238] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6238] ioctl(5, LOOP_CLR_FD) = 0 [pid 6238] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6238] close(5) = 0 [pid 6238] close(4) = 0 [pid 6238] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6238] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6237] <... futex resumed>) = 0 [pid 6237] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6238] <... futex resumed>) = 0 [pid 6237] <... futex resumed>) = 1 [pid 6238] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6237] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6238] <... openat resumed>) = 4 [pid 6238] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6237] <... futex resumed>) = 0 [pid 6238] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6237] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6238] <... write resumed>) = 12288 [pid 6237] <... futex resumed>) = 0 [pid 6237] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6238] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6237] <... futex resumed>) = 0 [pid 6237] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6237] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6238] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6238] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6237] <... futex resumed>) = 0 [pid 6237] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6237] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6238] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [ 132.036389][ T6238] loop0: detected capacity change from 0 to 64 [pid 6238] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6238] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6237] <... futex resumed>) = 0 [pid 6237] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6237] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6237] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6237] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6237] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6237] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6239 attached [pid 6239] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6237] <... clone3 resumed> => {parent_tid=[6239]}, 88) = 6239 [pid 6239] <... rseq resumed>) = 0 [pid 6239] set_robust_list(0x7f6d360d69a0, 24 [pid 6237] rt_sigprocmask(SIG_SETMASK, [], [pid 6239] <... set_robust_list resumed>) = 0 [pid 6237] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6239] rt_sigprocmask(SIG_SETMASK, [], [pid 6237] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6239] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6237] <... futex resumed>) = 0 [pid 6239] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6237] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6238] <... futex resumed>) = 1 [pid 6239] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6239] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6238] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6239] <... futex resumed>) = 1 [pid 6237] <... futex resumed>) = 0 [pid 6239] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6238] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [pid 6238] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6237] exit_group(0 [pid 6239] <... futex resumed>) = ? [pid 6237] <... exit_group resumed>) = ? [pid 6239] +++ exited with 0 +++ [pid 6238] <... futex resumed>) = ? [pid 6238] +++ exited with 0 +++ [pid 6237] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6237, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./397", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./397", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./397/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./397/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./397/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./397/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./397/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./397/bus") = 0 umount2("./397/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./397/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./397/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./397") = 0 mkdir("./398", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6240 attached , child_tidptr=0x5555564f6750) = 6240 [pid 6240] set_robust_list(0x5555564f6760, 24) = 0 [pid 6240] chdir("./398") = 0 [pid 6240] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6240] setpgid(0, 0) = 0 [pid 6240] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6240] write(3, "1000", 4) = 4 [pid 6240] close(3) = 0 [pid 6240] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6240] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6240] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6240] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6240] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6240] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6240] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6240] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6241 attached [pid 6241] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6240] <... clone3 resumed> => {parent_tid=[6241]}, 88) = 6241 [pid 6241] <... rseq resumed>) = 0 [pid 6240] rt_sigprocmask(SIG_SETMASK, [], [pid 6241] set_robust_list(0x7f6d468e79a0, 24 [pid 6240] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6241] <... set_robust_list resumed>) = 0 [pid 6240] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6241] rt_sigprocmask(SIG_SETMASK, [], [pid 6240] <... futex resumed>) = 0 [pid 6241] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6240] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6241] memfd_create("syzkaller", 0) = 3 [pid 6241] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6241] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6241] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6241] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6241] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6241] close(3) = 0 [pid 6241] mkdir("./bus", 0777) = 0 [pid 6241] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6241] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6241] chdir("./bus") = 0 [pid 6241] ioctl(4, LOOP_CLR_FD) = 0 [pid 6241] close(4) = 0 [pid 6241] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6241] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6240] <... futex resumed>) = 0 [pid 6240] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6241] <... futex resumed>) = 0 [pid 6240] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6241] memfd_create("syzkaller", 0) = 4 [pid 6241] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6241] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6241] munmap(0x7f6d360cf000, 32768) = 0 [pid 6241] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6241] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6241] ioctl(5, LOOP_CLR_FD) = 0 [pid 6241] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6241] close(5) = 0 [pid 6241] close(4) = 0 [pid 6241] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6240] <... futex resumed>) = 0 [pid 6241] <... futex resumed>) = 1 [pid 6241] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 6240] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6241] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6240] <... futex resumed>) = 0 [pid 6241] <... openat resumed>) = 4 [pid 6240] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6241] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6240] <... futex resumed>) = 0 [pid 6240] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6241] <... futex resumed>) = 1 [pid 6240] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6241] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6241] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6240] <... futex resumed>) = 0 [pid 6240] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6240] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6241] <... futex resumed>) = 1 [pid 6241] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6241] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6240] <... futex resumed>) = 0 [pid 6240] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6240] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6241] <... futex resumed>) = 1 [pid 6241] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [ 132.168297][ T6241] loop0: detected capacity change from 0 to 64 [pid 6241] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6241] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6240] <... futex resumed>) = 0 [pid 6240] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6240] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6241] <... futex resumed>) = 1 [pid 6240] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6241] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6241] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6240] <... mmap resumed>) = 0x7f6d360b6000 [pid 6241] <... openat resumed>) = 6 [pid 6240] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6241] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6240] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6241] <... futex resumed>) = 0 [pid 6241] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6240] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6240] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6242 attached [pid 6242] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6242] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6240] <... clone3 resumed> => {parent_tid=[6242]}, 88) = 6242 [pid 6242] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6242] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6240] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6240] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6242] <... futex resumed>) = 0 [pid 6240] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6242] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6242] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6240] <... futex resumed>) = 0 [pid 6242] <... futex resumed>) = 1 [pid 6242] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6240] exit_group(0 [pid 6241] <... futex resumed>) = ? [pid 6242] <... futex resumed>) = ? [pid 6240] <... exit_group resumed>) = ? [pid 6242] +++ exited with 0 +++ [pid 6241] +++ exited with 0 +++ [pid 6240] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6240, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./398", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./398", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./398/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./398/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./398/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./398/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./398/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./398/bus") = 0 umount2("./398/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./398/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./398/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./398") = 0 mkdir("./399", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6243 ./strace-static-x86_64: Process 6243 attached [pid 6243] set_robust_list(0x5555564f6760, 24) = 0 [pid 6243] chdir("./399") = 0 [pid 6243] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6243] setpgid(0, 0) = 0 [pid 6243] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6243] write(3, "1000", 4) = 4 [pid 6243] close(3) = 0 [pid 6243] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6243] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6243] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6243] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6243] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6243] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6243] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6243] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6244 attached => {parent_tid=[6244]}, 88) = 6244 [pid 6243] rt_sigprocmask(SIG_SETMASK, [], [pid 6244] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6243] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6243] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6244] <... rseq resumed>) = 0 [pid 6243] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6244] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6244] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6244] memfd_create("syzkaller", 0) = 3 [pid 6244] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6244] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6244] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6244] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6244] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6244] close(3) = 0 [pid 6244] mkdir("./bus", 0777) = 0 [pid 6244] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6244] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6244] chdir("./bus") = 0 [pid 6244] ioctl(4, LOOP_CLR_FD) = 0 [pid 6244] close(4) = 0 [pid 6244] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6244] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6243] <... futex resumed>) = 0 [pid 6243] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6244] <... futex resumed>) = 0 [pid 6244] memfd_create("syzkaller", 0) = 4 [pid 6244] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6243] <... futex resumed>) = 1 [pid 6243] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6244] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6244] munmap(0x7f6d360cf000, 32768) = 0 [pid 6244] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6244] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6244] ioctl(5, LOOP_CLR_FD) = 0 [pid 6244] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6244] close(5) = 0 [pid 6244] close(4) = 0 [pid 6244] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6243] <... futex resumed>) = 0 [pid 6243] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6244] <... futex resumed>) = 1 [pid 6244] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6243] <... futex resumed>) = 0 [pid 6244] <... openat resumed>) = 4 [pid 6243] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6244] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6243] <... futex resumed>) = 0 [pid 6243] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6243] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6244] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6244] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6243] <... futex resumed>) = 0 [pid 6243] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6243] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6244] <... futex resumed>) = 1 [pid 6244] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6244] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6243] <... futex resumed>) = 0 [pid 6243] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6243] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6244] <... futex resumed>) = 1 [pid 6244] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6244] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6244] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6243] <... futex resumed>) = 0 [pid 6243] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6243] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6243] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6243] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6243] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6243] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6245 attached [pid 6245] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6245] set_robust_list(0x7f6d360d69a0, 24 [pid 6243] <... clone3 resumed> => {parent_tid=[6245]}, 88) = 6245 [pid 6245] <... set_robust_list resumed>) = 0 [pid 6243] rt_sigprocmask(SIG_SETMASK, [], [pid 6245] rt_sigprocmask(SIG_SETMASK, [], [pid 6243] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6245] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6244] <... futex resumed>) = 1 [pid 6243] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6245] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6244] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6243] <... futex resumed>) = 0 [pid 6244] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6243] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6245] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6244] <... openat resumed>) = 6 [pid 6244] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6244] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6245] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6243] <... futex resumed>) = 0 [pid 6245] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6243] exit_group(0) = ? [pid 6245] <... futex resumed>) = ? [ 132.316483][ T6244] loop0: detected capacity change from 0 to 64 [pid 6245] +++ exited with 0 +++ [pid 6244] <... futex resumed>) = ? [pid 6244] +++ exited with 0 +++ [pid 6243] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6243, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./399", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./399", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./399/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./399/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./399/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./399/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./399/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./399/bus") = 0 umount2("./399/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./399/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./399/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./399") = 0 mkdir("./400", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6246 ./strace-static-x86_64: Process 6246 attached [pid 6246] set_robust_list(0x5555564f6760, 24) = 0 [pid 6246] chdir("./400") = 0 [pid 6246] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6246] setpgid(0, 0) = 0 [pid 6246] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6246] write(3, "1000", 4) = 4 [pid 6246] close(3) = 0 [pid 6246] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6246] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6246] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6246] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6246] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6246] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6246] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6246] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6247 attached => {parent_tid=[6247]}, 88) = 6247 [pid 6247] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6246] rt_sigprocmask(SIG_SETMASK, [], [pid 6247] set_robust_list(0x7f6d468e79a0, 24 [pid 6246] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6247] <... set_robust_list resumed>) = 0 [pid 6247] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6246] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6247] memfd_create("syzkaller", 0 [pid 6246] <... futex resumed>) = 0 [pid 6247] <... memfd_create resumed>) = 3 [pid 6246] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6247] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6247] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6247] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6247] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6247] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6247] close(3) = 0 [pid 6247] mkdir("./bus", 0777) = 0 [pid 6247] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6247] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6247] chdir("./bus") = 0 [pid 6247] ioctl(4, LOOP_CLR_FD) = 0 [pid 6247] close(4) = 0 [pid 6247] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6246] <... futex resumed>) = 0 [pid 6247] memfd_create("syzkaller", 0 [pid 6246] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6247] <... memfd_create resumed>) = 4 [pid 6247] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6247] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6247] munmap(0x7f6d360cf000, 32768) = 0 [pid 6247] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 6246] <... futex resumed>) = 0 [pid 6247] <... openat resumed>) = 5 [pid 6246] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6247] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6247] ioctl(5, LOOP_CLR_FD) = 0 [pid 6247] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6247] close(5) = 0 [pid 6247] close(4) = 0 [pid 6247] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6246] <... futex resumed>) = 0 [pid 6247] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6246] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6247] <... futex resumed>) = 0 [pid 6246] <... futex resumed>) = 1 [pid 6247] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6246] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6247] <... openat resumed>) = 4 [pid 6247] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6246] <... futex resumed>) = 0 [pid 6247] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6246] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6247] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6246] <... futex resumed>) = 0 [pid 6247] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6246] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6247] <... write resumed>) = 12288 [pid 6247] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6246] <... futex resumed>) = 0 [pid 6247] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6246] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6247] <... mmap resumed>) = 0x20000000 [pid 6246] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6247] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6246] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6247] <... futex resumed>) = 0 [pid 6246] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6247] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6246] <... futex resumed>) = 0 [pid 6247] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6246] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6247] <... openat resumed>) = 5 [pid 6247] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6246] <... futex resumed>) = 0 [pid 6247] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6246] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6247] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6246] <... futex resumed>) = 0 [pid 6247] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6246] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6247] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [pid 6246] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6247] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6246] <... mmap resumed>) = 0x7f6d360b6000 [pid 6247] <... futex resumed>) = 0 [pid 6247] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [ 132.461118][ T6247] loop0: detected capacity change from 0 to 64 [pid 6246] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6246] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6246] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6248 attached [pid 6248] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6246] <... clone3 resumed> => {parent_tid=[6248]}, 88) = 6248 [pid 6248] <... rseq resumed>) = 0 [pid 6246] rt_sigprocmask(SIG_SETMASK, [], [pid 6248] set_robust_list(0x7f6d360d69a0, 24 [pid 6246] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6248] <... set_robust_list resumed>) = 0 [pid 6248] rt_sigprocmask(SIG_SETMASK, [], [pid 6246] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6248] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6246] <... futex resumed>) = 0 [pid 6248] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6246] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6248] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6248] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6246] <... futex resumed>) = 0 [pid 6248] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6246] exit_group(0 [pid 6247] <... futex resumed>) = ? [pid 6248] <... futex resumed>) = ? [pid 6246] <... exit_group resumed>) = ? [pid 6248] +++ exited with 0 +++ [pid 6247] +++ exited with 0 +++ [pid 6246] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6246, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./400", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./400", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./400/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./400/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./400/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./400/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./400/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./400/bus") = 0 umount2("./400/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./400/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./400/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./400") = 0 mkdir("./401", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6249 ./strace-static-x86_64: Process 6249 attached [pid 6249] set_robust_list(0x5555564f6760, 24) = 0 [pid 6249] chdir("./401") = 0 [pid 6249] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6249] setpgid(0, 0) = 0 [pid 6249] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6249] write(3, "1000", 4) = 4 [pid 6249] close(3) = 0 [pid 6249] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6249] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6249] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6249] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6249] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6249] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6249] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6249] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6250 attached [pid 6250] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6249] <... clone3 resumed> => {parent_tid=[6250]}, 88) = 6250 [pid 6250] <... rseq resumed>) = 0 [pid 6249] rt_sigprocmask(SIG_SETMASK, [], [pid 6250] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6250] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6250] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6249] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6249] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6250] <... futex resumed>) = 0 [pid 6250] memfd_create("syzkaller", 0 [pid 6249] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6250] <... memfd_create resumed>) = 3 [pid 6250] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6250] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6250] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6250] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6250] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6250] close(3) = 0 [pid 6250] mkdir("./bus", 0777) = 0 [pid 6250] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6250] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6250] chdir("./bus") = 0 [pid 6250] ioctl(4, LOOP_CLR_FD) = 0 [pid 6250] close(4) = 0 [pid 6250] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6249] <... futex resumed>) = 0 [pid 6250] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6249] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6250] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6249] <... futex resumed>) = 0 [pid 6250] memfd_create("syzkaller", 0 [pid 6249] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6250] <... memfd_create resumed>) = 4 [pid 6250] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6250] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6250] munmap(0x7f6d360cf000, 32768) = 0 [pid 6250] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6250] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6250] ioctl(5, LOOP_CLR_FD) = 0 [pid 6250] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6250] close(5) = 0 [pid 6250] close(4) = 0 [pid 6250] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6249] <... futex resumed>) = 0 [pid 6250] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6249] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6250] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6249] <... futex resumed>) = 0 [pid 6250] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6249] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6250] <... openat resumed>) = 4 [pid 6250] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6249] <... futex resumed>) = 0 [pid 6250] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6249] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6250] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6249] <... futex resumed>) = 0 [pid 6250] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6249] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6250] <... write resumed>) = 12288 [pid 6250] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6249] <... futex resumed>) = 0 [pid 6249] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6250] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6249] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6250] <... mmap resumed>) = 0x20000000 [pid 6250] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6249] <... futex resumed>) = 0 [pid 6250] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6249] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6250] <... futex resumed>) = 0 [pid 6249] <... futex resumed>) = 1 [pid 6250] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6249] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6250] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6250] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6249] <... futex resumed>) = 0 [pid 6250] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6249] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6250] <... futex resumed>) = 0 [pid 6250] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6249] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6250] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6249] <... futex resumed>) = 0 [pid 6249] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6249] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6250] <... openat resumed>) = 6 [ 132.612445][ T6250] loop0: detected capacity change from 0 to 64 [pid 6249] <... mprotect resumed>) = 0 [pid 6250] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6250] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6249] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6249] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} => {parent_tid=[6251]}, 88) = 6251 ./strace-static-x86_64: Process 6251 attached [pid 6249] rt_sigprocmask(SIG_SETMASK, [], [pid 6251] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6249] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6251] <... rseq resumed>) = 0 [pid 6249] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6251] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6249] <... futex resumed>) = 0 [pid 6251] rt_sigprocmask(SIG_SETMASK, [], [pid 6249] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6251] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6251] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6251] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6251] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6249] <... futex resumed>) = 0 [pid 6249] exit_group(0) = ? [pid 6251] <... futex resumed>) = ? [pid 6250] <... futex resumed>) = ? [pid 6251] +++ exited with 0 +++ [pid 6250] +++ exited with 0 +++ [pid 6249] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6249, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./401", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./401", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./401/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./401/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./401/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./401/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./401/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./401/bus") = 0 umount2("./401/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./401/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./401/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./401") = 0 mkdir("./402", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6252 ./strace-static-x86_64: Process 6252 attached [pid 6252] set_robust_list(0x5555564f6760, 24) = 0 [pid 6252] chdir("./402") = 0 [pid 6252] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6252] setpgid(0, 0) = 0 [pid 6252] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6252] write(3, "1000", 4) = 4 [pid 6252] close(3) = 0 [pid 6252] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6252] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6252] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6252] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6252] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6252] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6252] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6252] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6253 attached [pid 6253] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6252] <... clone3 resumed> => {parent_tid=[6253]}, 88) = 6253 [pid 6252] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6252] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6253] <... rseq resumed>) = 0 [pid 6252] <... futex resumed>) = 0 [pid 6253] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6253] rt_sigprocmask(SIG_SETMASK, [], [pid 6252] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6253] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6253] memfd_create("syzkaller", 0) = 3 [pid 6253] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6253] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6253] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6253] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6253] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6253] close(3) = 0 [pid 6253] mkdir("./bus", 0777) = 0 [pid 6253] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6253] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6253] chdir("./bus") = 0 [pid 6253] ioctl(4, LOOP_CLR_FD) = 0 [pid 6253] close(4) = 0 [pid 6253] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6253] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6252] <... futex resumed>) = 0 [pid 6252] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6253] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6253] memfd_create("syzkaller", 0) = 4 [pid 6253] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6253] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6253] munmap(0x7f6d360cf000, 32768 [pid 6252] <... futex resumed>) = 0 [pid 6253] <... munmap resumed>) = 0 [pid 6252] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6253] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6253] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6253] ioctl(5, LOOP_CLR_FD) = 0 [pid 6253] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6253] close(5) = 0 [pid 6253] close(4) = 0 [pid 6253] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6252] <... futex resumed>) = 0 [pid 6253] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6252] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6253] <... openat resumed>) = 4 [pid 6252] <... futex resumed>) = 0 [pid 6253] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6253] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6252] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 6252] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6253] <... futex resumed>) = 0 [pid 6252] <... futex resumed>) = 1 [pid 6253] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6252] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6253] <... write resumed>) = 12288 [pid 6253] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6253] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6252] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6252] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6253] <... futex resumed>) = 0 [pid 6253] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6252] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6253] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6252] <... futex resumed>) = 0 [pid 6252] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6252] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6253] <... futex resumed>) = 1 [pid 6253] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6253] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6253] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6252] <... futex resumed>) = 0 [pid 6252] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6252] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6252] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6252] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6252] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6252] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6254 attached [pid 6254] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6252] <... clone3 resumed> => {parent_tid=[6254]}, 88) = 6254 [pid 6254] <... rseq resumed>) = 0 [pid 6253] <... futex resumed>) = 1 [pid 6252] rt_sigprocmask(SIG_SETMASK, [], [pid 6254] set_robust_list(0x7f6d360d69a0, 24 [pid 6253] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6252] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6254] <... set_robust_list resumed>) = 0 [pid 6253] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6252] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6254] rt_sigprocmask(SIG_SETMASK, [], [pid 6252] <... futex resumed>) = 0 [pid 6254] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6253] <... openat resumed>) = 6 [pid 6252] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6254] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6253] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6253] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6254] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6252] <... futex resumed>) = 0 [pid 6252] exit_group(0 [pid 6254] <... futex resumed>) = ? [pid 6253] <... futex resumed>) = ? [pid 6252] <... exit_group resumed>) = ? [pid 6254] +++ exited with 0 +++ [pid 6253] +++ exited with 0 +++ [pid 6252] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6252, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./402", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./402", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 [ 132.739072][ T6253] loop0: detected capacity change from 0 to 64 umount2("./402/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./402/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./402/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./402/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./402/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./402/bus") = 0 umount2("./402/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./402/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./402/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./402") = 0 mkdir("./403", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6255 ./strace-static-x86_64: Process 6255 attached [pid 6255] set_robust_list(0x5555564f6760, 24) = 0 [pid 6255] chdir("./403") = 0 [pid 6255] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6255] setpgid(0, 0) = 0 [pid 6255] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6255] write(3, "1000", 4) = 4 [pid 6255] close(3) = 0 [pid 6255] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6255] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6255] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6255] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6255] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6255] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6255] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6255] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6256 attached => {parent_tid=[6256]}, 88) = 6256 [pid 6255] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6256] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6256] set_robust_list(0x7f6d468e79a0, 24 [pid 6255] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6256] <... set_robust_list resumed>) = 0 [pid 6256] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6255] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6256] memfd_create("syzkaller", 0) = 3 [pid 6256] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6256] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6256] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6256] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6256] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6256] close(3) = 0 [pid 6256] mkdir("./bus", 0777) = 0 [pid 6256] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6256] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6256] chdir("./bus") = 0 [pid 6256] ioctl(4, LOOP_CLR_FD) = 0 [pid 6256] close(4) = 0 [pid 6256] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6256] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6255] <... futex resumed>) = 0 [pid 6255] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6255] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6256] <... futex resumed>) = 0 [pid 6256] memfd_create("syzkaller", 0) = 4 [pid 6256] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6256] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6256] munmap(0x7f6d360cf000, 32768) = 0 [pid 6256] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6256] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6256] ioctl(5, LOOP_CLR_FD) = 0 [pid 6256] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6256] close(5) = 0 [pid 6256] close(4) = 0 [pid 6256] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6256] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6255] <... futex resumed>) = 0 [pid 6255] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6256] <... futex resumed>) = 0 [pid 6255] <... futex resumed>) = 1 [pid 6256] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6255] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6256] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6255] <... futex resumed>) = 0 [pid 6256] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6255] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6256] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6255] <... futex resumed>) = 0 [pid 6256] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6255] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6256] <... write resumed>) = 12288 [pid 6256] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6256] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6255] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6255] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6255] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6256] <... futex resumed>) = 0 [pid 6256] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6256] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6255] <... futex resumed>) = 0 [pid 6255] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6255] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6256] <... futex resumed>) = 1 [pid 6256] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6256] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6256] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6255] <... futex resumed>) = 0 [pid 6255] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6256] <... futex resumed>) = 1 [pid 6255] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6256] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6256] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6255] <... futex resumed>) = 0 [pid 6255] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6256] <... openat resumed>) = 6 [pid 6255] <... mmap resumed>) = 0x7f6d360b6000 [pid 6255] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6255] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6256] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6255] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6256] <... futex resumed>) = 0 [pid 6255] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6256] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 6257 attached [pid 6257] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6255] <... clone3 resumed> => {parent_tid=[6257]}, 88) = 6257 [pid 6255] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6255] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6255] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6257] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6257] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 132.868313][ T6256] loop0: detected capacity change from 0 to 64 [pid 6257] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6257] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6255] <... futex resumed>) = 0 [pid 6257] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6255] exit_group(0 [pid 6256] <... futex resumed>) = ? [pid 6257] <... futex resumed>) = ? [pid 6255] <... exit_group resumed>) = ? [pid 6256] +++ exited with 0 +++ [pid 6257] +++ exited with 0 +++ [pid 6255] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6255, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./403", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./403", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./403/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./403/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./403/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./403/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./403/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./403/bus") = 0 umount2("./403/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./403/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./403/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./403") = 0 mkdir("./404", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6258 attached , child_tidptr=0x5555564f6750) = 6258 [pid 6258] set_robust_list(0x5555564f6760, 24) = 0 [pid 6258] chdir("./404") = 0 [pid 6258] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6258] setpgid(0, 0) = 0 [pid 6258] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6258] write(3, "1000", 4) = 4 [pid 6258] close(3) = 0 [pid 6258] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6258] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6258] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6258] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6258] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6258] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6258] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6258] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6259 attached => {parent_tid=[6259]}, 88) = 6259 [pid 6259] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6258] rt_sigprocmask(SIG_SETMASK, [], [pid 6259] <... rseq resumed>) = 0 [pid 6259] set_robust_list(0x7f6d468e79a0, 24 [pid 6258] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6259] <... set_robust_list resumed>) = 0 [pid 6258] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6259] rt_sigprocmask(SIG_SETMASK, [], [pid 6258] <... futex resumed>) = 0 [pid 6258] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6259] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6259] memfd_create("syzkaller", 0) = 3 [pid 6259] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6259] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6259] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6259] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6259] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6259] close(3) = 0 [pid 6259] mkdir("./bus", 0777) = 0 [pid 6259] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6259] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6259] chdir("./bus") = 0 [pid 6259] ioctl(4, LOOP_CLR_FD) = 0 [pid 6259] close(4) = 0 [pid 6259] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6259] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6258] <... futex resumed>) = 0 [pid 6258] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6259] <... futex resumed>) = 0 [pid 6258] <... futex resumed>) = 1 [pid 6259] memfd_create("syzkaller", 0 [pid 6258] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6259] <... memfd_create resumed>) = 4 [pid 6259] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6259] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6259] munmap(0x7f6d360cf000, 32768) = 0 [pid 6259] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6259] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6259] ioctl(5, LOOP_CLR_FD) = 0 [pid 6259] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6259] close(5) = 0 [pid 6259] close(4) = 0 [pid 6259] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6258] <... futex resumed>) = 0 [pid 6258] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6258] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6259] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6259] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6258] <... futex resumed>) = 0 [pid 6258] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6258] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6259] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6259] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6258] <... futex resumed>) = 0 [pid 6258] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6258] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6259] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6259] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6258] <... futex resumed>) = 0 [pid 6258] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6258] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6259] <... futex resumed>) = 1 [pid 6259] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6259] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6259] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6258] <... futex resumed>) = 0 [pid 6258] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 133.020926][ T6259] loop0: detected capacity change from 0 to 64 [pid 6258] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6258] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6258] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6259] <... futex resumed>) = 1 [pid 6258] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6259] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6259] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6258] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6258] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6259] <... openat resumed>) = 6 [pid 6258] <... clone3 resumed> => {parent_tid=[6260]}, 88) = 6260 [pid 6258] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6258] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6258] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6259] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 6260 attached [pid 6259] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6260] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6260] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6260] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6260] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6260] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6260] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6258] <... futex resumed>) = 0 [pid 6258] exit_group(0 [pid 6259] <... futex resumed>) = ? [pid 6258] <... exit_group resumed>) = ? [pid 6259] +++ exited with 0 +++ [pid 6260] <... futex resumed>) = ? [pid 6260] +++ exited with 0 +++ [pid 6258] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6258, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./404", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./404", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./404/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./404/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./404/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./404/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./404/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./404/bus") = 0 umount2("./404/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./404/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./404/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./404") = 0 mkdir("./405", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6261 attached , child_tidptr=0x5555564f6750) = 6261 [pid 6261] set_robust_list(0x5555564f6760, 24) = 0 [pid 6261] chdir("./405") = 0 [pid 6261] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6261] setpgid(0, 0) = 0 [pid 6261] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6261] write(3, "1000", 4) = 4 [pid 6261] close(3) = 0 [pid 6261] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6261] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6261] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6261] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6261] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6261] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6261] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6261] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6262 attached => {parent_tid=[6262]}, 88) = 6262 [pid 6261] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6261] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6262] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6261] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6262] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6262] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6262] memfd_create("syzkaller", 0) = 3 [pid 6262] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6262] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6262] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6262] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6262] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6262] close(3) = 0 [pid 6262] mkdir("./bus", 0777) = 0 [pid 6262] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6262] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6262] chdir("./bus") = 0 [pid 6262] ioctl(4, LOOP_CLR_FD) = 0 [pid 6262] close(4) = 0 [pid 6262] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6261] <... futex resumed>) = 0 [pid 6262] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6261] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6262] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6261] <... futex resumed>) = 0 [pid 6261] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6262] memfd_create("syzkaller", 0) = 4 [pid 6262] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6262] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6262] munmap(0x7f6d360cf000, 32768) = 0 [pid 6262] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6262] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6262] ioctl(5, LOOP_CLR_FD) = 0 [pid 6262] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [ 133.158219][ T6262] loop0: detected capacity change from 0 to 64 [pid 6262] close(5) = 0 [pid 6262] close(4) = 0 [pid 6262] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6261] <... futex resumed>) = 0 [pid 6262] <... futex resumed>) = 1 [pid 6261] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6262] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6261] <... futex resumed>) = 0 [pid 6262] <... openat resumed>) = 4 [pid 6261] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6262] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6261] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6262] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6261] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6262] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6261] <... futex resumed>) = 0 [pid 6262] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6261] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6262] <... write resumed>) = 12288 [pid 6262] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6261] <... futex resumed>) = 0 [pid 6262] <... futex resumed>) = 1 [pid 6261] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6262] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6261] <... futex resumed>) = 0 [pid 6262] <... mmap resumed>) = 0x20000000 [pid 6261] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6262] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6261] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6262] <... futex resumed>) = 0 [pid 6261] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6262] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6261] <... futex resumed>) = 0 [pid 6262] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6261] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6262] <... openat resumed>) = 5 [pid 6262] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6262] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6261] <... futex resumed>) = 0 [pid 6261] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6262] <... futex resumed>) = 0 [pid 6262] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6262] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [pid 6261] <... futex resumed>) = 1 [pid 6261] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6262] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6261] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6262] <... futex resumed>) = 0 [pid 6261] <... mmap resumed>) = 0x7f6d360b6000 [pid 6262] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6261] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6261] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6261] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6263 attached [pid 6263] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6261] <... clone3 resumed> => {parent_tid=[6263]}, 88) = 6263 [pid 6263] <... rseq resumed>) = 0 [pid 6261] rt_sigprocmask(SIG_SETMASK, [], [pid 6263] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6261] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6263] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6261] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6263] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6261] <... futex resumed>) = 0 [pid 6261] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6263] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6263] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6261] <... futex resumed>) = 0 [pid 6263] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6261] exit_group(0 [pid 6262] <... futex resumed>) = ? [pid 6263] <... futex resumed>) = ? [pid 6262] +++ exited with 0 +++ [pid 6261] <... exit_group resumed>) = ? [pid 6263] +++ exited with 0 +++ [pid 6261] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6261, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./405", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./405", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./405/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./405/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./405/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./405/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./405/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./405/bus") = 0 umount2("./405/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./405/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./405/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./405") = 0 mkdir("./406", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6264 attached , child_tidptr=0x5555564f6750) = 6264 [pid 6264] set_robust_list(0x5555564f6760, 24) = 0 [pid 6264] chdir("./406") = 0 [pid 6264] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6264] setpgid(0, 0) = 0 [pid 6264] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6264] write(3, "1000", 4) = 4 [pid 6264] close(3) = 0 [pid 6264] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6264] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6264] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6264] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6264] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6264] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6264] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6264] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6265 attached [pid 6265] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6264] <... clone3 resumed> => {parent_tid=[6265]}, 88) = 6265 [pid 6265] <... rseq resumed>) = 0 [pid 6264] rt_sigprocmask(SIG_SETMASK, [], [pid 6265] set_robust_list(0x7f6d468e79a0, 24 [pid 6264] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6265] <... set_robust_list resumed>) = 0 [pid 6264] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6265] rt_sigprocmask(SIG_SETMASK, [], [pid 6264] <... futex resumed>) = 0 [pid 6265] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6264] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6265] memfd_create("syzkaller", 0) = 3 [pid 6265] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6265] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6265] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6265] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6265] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6265] close(3) = 0 [pid 6265] mkdir("./bus", 0777) = 0 [pid 6265] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6265] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6265] chdir("./bus") = 0 [pid 6265] ioctl(4, LOOP_CLR_FD) = 0 [pid 6265] close(4) = 0 [pid 6265] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6265] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6264] <... futex resumed>) = 0 [pid 6264] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6265] <... futex resumed>) = 0 [pid 6264] <... futex resumed>) = 1 [pid 6265] memfd_create("syzkaller", 0 [pid 6264] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6265] <... memfd_create resumed>) = 4 [pid 6265] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6265] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6265] munmap(0x7f6d360cf000, 32768) = 0 [pid 6265] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6265] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6265] ioctl(5, LOOP_CLR_FD) = 0 [pid 6265] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6265] close(5) = 0 [pid 6265] close(4) = 0 [pid 6265] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6264] <... futex resumed>) = 0 [pid 6264] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6265] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6264] <... futex resumed>) = 0 [pid 6264] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6265] <... openat resumed>) = 4 [pid 6265] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6264] <... futex resumed>) = 0 [pid 6265] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6264] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6264] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6265] <... write resumed>) = 12288 [pid 6265] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6265] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6264] <... futex resumed>) = 0 [pid 6264] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6265] <... futex resumed>) = 0 [pid 6264] <... futex resumed>) = 1 [pid 6265] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6264] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6265] <... mmap resumed>) = 0x20000000 [pid 6265] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6264] <... futex resumed>) = 0 [pid 6264] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6265] <... futex resumed>) = 1 [pid 6264] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6265] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6265] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6265] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6264] <... futex resumed>) = 0 [pid 6265] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6264] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6265] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6264] <... futex resumed>) = 0 [pid 6265] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6265] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6264] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6265] <... openat resumed>) = 6 [pid 6265] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6264] <... futex resumed>) = 0 [pid 6265] <... futex resumed>) = 0 [pid 6264] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6265] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6264] <... mmap resumed>) = 0x7f6d360b6000 [ 133.321310][ T6265] loop0: detected capacity change from 0 to 64 [pid 6264] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6264] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6264] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6266 attached [pid 6266] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6266] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6266] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6266] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6264] <... clone3 resumed> => {parent_tid=[6266]}, 88) = 6266 [pid 6264] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6264] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6266] <... futex resumed>) = 0 [pid 6266] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6264] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6266] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6264] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6266] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6264] exit_group(0 [pid 6266] <... futex resumed>) = ? [pid 6265] <... futex resumed>) = ? [pid 6264] <... exit_group resumed>) = ? [pid 6266] +++ exited with 0 +++ [pid 6265] +++ exited with 0 +++ [pid 6264] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6264, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./406", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./406", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./406/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./406/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./406/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./406/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./406/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./406/bus") = 0 umount2("./406/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./406/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./406/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./406") = 0 mkdir("./407", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6267 attached , child_tidptr=0x5555564f6750) = 6267 [pid 6267] set_robust_list(0x5555564f6760, 24) = 0 [pid 6267] chdir("./407") = 0 [pid 6267] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6267] setpgid(0, 0) = 0 [pid 6267] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6267] write(3, "1000", 4) = 4 [pid 6267] close(3) = 0 [pid 6267] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6267] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6267] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6267] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6267] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6267] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6267] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6267] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0} => {parent_tid=[6268]}, 88) = 6268 ./strace-static-x86_64: Process 6268 attached [pid 6267] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6267] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6268] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6267] <... futex resumed>) = 0 [pid 6267] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6268] <... rseq resumed>) = 0 [pid 6268] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6268] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6268] memfd_create("syzkaller", 0) = 3 [pid 6268] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6268] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6268] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6268] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6268] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6268] close(3) = 0 [pid 6268] mkdir("./bus", 0777) = 0 [pid 6268] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6268] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6268] chdir("./bus") = 0 [pid 6268] ioctl(4, LOOP_CLR_FD) = 0 [pid 6268] close(4) = 0 [pid 6268] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6267] <... futex resumed>) = 0 [pid 6267] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6267] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6268] memfd_create("syzkaller", 0) = 4 [pid 6268] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6268] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6268] munmap(0x7f6d360cf000, 32768) = 0 [pid 6268] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6268] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6268] ioctl(5, LOOP_CLR_FD) = 0 [pid 6268] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6268] close(5) = 0 [pid 6268] close(4) = 0 [pid 6268] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6267] <... futex resumed>) = 0 [pid 6268] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6267] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6268] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6267] <... futex resumed>) = 0 [pid 6268] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6267] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6268] <... openat resumed>) = 4 [pid 6268] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6267] <... futex resumed>) = 0 [pid 6267] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6268] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6267] <... futex resumed>) = 0 [pid 6268] <... write resumed>) = 12288 [pid 6267] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6268] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6267] <... futex resumed>) = 0 [pid 6267] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6267] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6268] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6268] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6267] <... futex resumed>) = 0 [pid 6268] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6267] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6268] <... futex resumed>) = 0 [pid 6267] <... futex resumed>) = 1 [pid 6268] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6267] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6268] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6268] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6267] <... futex resumed>) = 0 [pid 6268] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6267] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6268] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6267] <... futex resumed>) = 0 [pid 6268] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6267] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6268] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6267] <... futex resumed>) = 0 [pid 6268] <... openat resumed>) = 6 [pid 6267] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6268] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6267] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6268] <... futex resumed>) = 0 [pid 6267] <... mprotect resumed>) = 0 [pid 6268] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6267] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [ 133.484793][ T6268] loop0: detected capacity change from 0 to 64 [pid 6267] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6269 attached [pid 6269] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6267] <... clone3 resumed> => {parent_tid=[6269]}, 88) = 6269 [pid 6269] set_robust_list(0x7f6d360d69a0, 24 [pid 6267] rt_sigprocmask(SIG_SETMASK, [], [pid 6269] <... set_robust_list resumed>) = 0 [pid 6267] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6269] rt_sigprocmask(SIG_SETMASK, [], [pid 6267] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6269] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6269] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6267] <... futex resumed>) = 0 [pid 6267] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6269] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6269] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6267] <... futex resumed>) = 0 [pid 6269] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6267] exit_group(0 [pid 6268] <... futex resumed>) = ? [pid 6269] <... futex resumed>) = ? [pid 6267] <... exit_group resumed>) = ? [pid 6269] +++ exited with 0 +++ [pid 6268] +++ exited with 0 +++ [pid 6267] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6267, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./407", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./407", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./407/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./407/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./407/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./407/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./407/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./407/bus") = 0 umount2("./407/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./407/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./407/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./407") = 0 mkdir("./408", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6270 attached , child_tidptr=0x5555564f6750) = 6270 [pid 6270] set_robust_list(0x5555564f6760, 24) = 0 [pid 6270] chdir("./408") = 0 [pid 6270] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6270] setpgid(0, 0) = 0 [pid 6270] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6270] write(3, "1000", 4) = 4 [pid 6270] close(3) = 0 [pid 6270] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6270] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6270] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6270] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6270] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6270] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6270] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6270] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6271 attached [pid 6271] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6270] <... clone3 resumed> => {parent_tid=[6271]}, 88) = 6271 [pid 6271] <... rseq resumed>) = 0 [pid 6270] rt_sigprocmask(SIG_SETMASK, [], [pid 6271] set_robust_list(0x7f6d468e79a0, 24 [pid 6270] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6271] <... set_robust_list resumed>) = 0 [pid 6270] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6271] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6270] <... futex resumed>) = 0 [pid 6271] memfd_create("syzkaller", 0 [pid 6270] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6271] <... memfd_create resumed>) = 3 [pid 6271] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6271] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6271] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6271] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6271] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6271] close(3) = 0 [pid 6271] mkdir("./bus", 0777) = 0 [pid 6271] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6271] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6271] chdir("./bus") = 0 [pid 6271] ioctl(4, LOOP_CLR_FD) = 0 [pid 6271] close(4) = 0 [pid 6271] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6271] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6270] <... futex resumed>) = 0 [pid 6270] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6270] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6271] <... futex resumed>) = 0 [pid 6271] memfd_create("syzkaller", 0) = 4 [pid 6271] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6271] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6271] munmap(0x7f6d360cf000, 32768) = 0 [pid 6271] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6271] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6271] ioctl(5, LOOP_CLR_FD) = 0 [pid 6271] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6271] close(5) = 0 [pid 6271] close(4) = 0 [pid 6271] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6271] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6270] <... futex resumed>) = 0 [pid 6270] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6271] <... futex resumed>) = 0 [pid 6271] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6270] <... futex resumed>) = 1 [pid 6271] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6270] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6271] <... futex resumed>) = 0 [pid 6270] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6271] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6270] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6271] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6271] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6271] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6270] <... futex resumed>) = 0 [pid 6270] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 6270] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6270] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6271] <... futex resumed>) = 1 [pid 6270] <... futex resumed>) = 0 [pid 6270] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=49000000} [pid 6271] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6271] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6270] <... futex resumed>) = 0 [pid 6270] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6271] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6270] <... futex resumed>) = 0 [pid 6270] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6271] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6271] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6270] <... futex resumed>) = 0 [pid 6271] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6270] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6270] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6270] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6270] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6270] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6271] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6270] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6271] <... openat resumed>) = 6 ./strace-static-x86_64: Process 6272 attached [pid 6272] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6270] <... clone3 resumed> => {parent_tid=[6272]}, 88) = 6272 [pid 6272] <... rseq resumed>) = 0 [pid 6270] rt_sigprocmask(SIG_SETMASK, [], [pid 6272] set_robust_list(0x7f6d360d69a0, 24 [pid 6270] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6272] <... set_robust_list resumed>) = 0 [pid 6270] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6272] rt_sigprocmask(SIG_SETMASK, [], [pid 6270] <... futex resumed>) = 0 [pid 6272] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6270] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6272] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6271] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6272] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6271] <... futex resumed>) = 0 [pid 6272] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6271] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6272] <... futex resumed>) = 1 [pid 6270] <... futex resumed>) = 0 [pid 6272] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6270] exit_group(0 [pid 6272] <... futex resumed>) = ? [pid 6271] <... futex resumed>) = ? [pid 6270] <... exit_group resumed>) = ? [pid 6272] +++ exited with 0 +++ [pid 6271] +++ exited with 0 +++ [pid 6270] +++ exited with 0 +++ [ 133.617960][ T6271] loop0: detected capacity change from 0 to 64 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6270, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./408", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./408", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./408/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./408/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./408/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./408/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./408/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./408/bus") = 0 umount2("./408/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./408/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./408/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./408") = 0 mkdir("./409", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6273 attached , child_tidptr=0x5555564f6750) = 6273 [pid 6273] set_robust_list(0x5555564f6760, 24) = 0 [pid 6273] chdir("./409") = 0 [pid 6273] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6273] setpgid(0, 0) = 0 [pid 6273] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6273] write(3, "1000", 4) = 4 [pid 6273] close(3) = 0 [pid 6273] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6273] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6273] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6273] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6273] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6273] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6273] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6273] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0} => {parent_tid=[6274]}, 88) = 6274 ./strace-static-x86_64: Process 6274 attached [pid 6274] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6273] rt_sigprocmask(SIG_SETMASK, [], [pid 6274] <... rseq resumed>) = 0 [pid 6274] set_robust_list(0x7f6d468e79a0, 24 [pid 6273] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6273] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6273] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6274] <... set_robust_list resumed>) = 0 [pid 6274] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6274] memfd_create("syzkaller", 0) = 3 [pid 6274] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6274] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6274] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6274] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6274] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6274] close(3) = 0 [pid 6274] mkdir("./bus", 0777) = 0 [pid 6274] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6274] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6274] chdir("./bus") = 0 [pid 6274] ioctl(4, LOOP_CLR_FD) = 0 [pid 6274] close(4) = 0 [pid 6274] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6273] <... futex resumed>) = 0 [pid 6274] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6273] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6274] <... futex resumed>) = 0 [pid 6273] <... futex resumed>) = 1 [pid 6274] memfd_create("syzkaller", 0) = 4 [pid 6273] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6274] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6274] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6274] munmap(0x7f6d360cf000, 32768) = 0 [pid 6274] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6274] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6274] ioctl(5, LOOP_CLR_FD) = 0 [pid 6274] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6274] close(5) = 0 [pid 6274] close(4) = 0 [pid 6274] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6273] <... futex resumed>) = 0 [pid 6273] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6273] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6274] <... futex resumed>) = 1 [pid 6274] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6274] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6273] <... futex resumed>) = 0 [pid 6273] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6273] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6274] <... futex resumed>) = 1 [pid 6274] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6274] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6273] <... futex resumed>) = 0 [pid 6273] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6274] <... futex resumed>) = 1 [pid 6273] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6274] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6274] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6273] <... futex resumed>) = 0 [pid 6274] <... futex resumed>) = 1 [pid 6273] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6274] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6274] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6273] <... futex resumed>) = 0 [pid 6273] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6274] <... openat resumed>) = 5 [pid 6274] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6273] <... futex resumed>) = 0 [pid 6274] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 6273] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6274] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6273] <... futex resumed>) = 0 [pid 6273] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6274] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6273] <... futex resumed>) = 0 [pid 6274] <... openat resumed>) = 6 [pid 6273] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6274] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6273] <... mmap resumed>) = 0x7f6d360b6000 [pid 6274] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6273] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6273] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6273] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} => {parent_tid=[6275]}, 88) = 6275 [pid 6273] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6273] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 6275 attached [pid 6275] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6275] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6273] <... futex resumed>) = 0 [pid 6275] rt_sigprocmask(SIG_SETMASK, [], [pid 6273] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6275] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6275] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6275] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6273] <... futex resumed>) = 0 [pid 6275] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6273] exit_group(0 [pid 6275] <... futex resumed>) = ? [pid 6274] <... futex resumed>) = ? [pid 6273] <... exit_group resumed>) = ? [ 133.739196][ T6274] loop0: detected capacity change from 0 to 64 [pid 6275] +++ exited with 0 +++ [pid 6274] +++ exited with 0 +++ [pid 6273] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6273, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./409", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./409", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./409/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./409/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./409/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./409/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./409/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./409/bus") = 0 umount2("./409/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./409/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./409/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./409") = 0 mkdir("./410", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6276 attached , child_tidptr=0x5555564f6750) = 6276 [pid 6276] set_robust_list(0x5555564f6760, 24) = 0 [pid 6276] chdir("./410") = 0 [pid 6276] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6276] setpgid(0, 0) = 0 [pid 6276] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6276] write(3, "1000", 4) = 4 [pid 6276] close(3) = 0 [pid 6276] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6276] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6276] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6276] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6276] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6276] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6276] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6276] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6277 attached [pid 6277] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6276] <... clone3 resumed> => {parent_tid=[6277]}, 88) = 6277 [pid 6277] <... rseq resumed>) = 0 [pid 6276] rt_sigprocmask(SIG_SETMASK, [], [pid 6277] set_robust_list(0x7f6d468e79a0, 24 [pid 6276] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6277] <... set_robust_list resumed>) = 0 [pid 6276] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6277] rt_sigprocmask(SIG_SETMASK, [], [pid 6276] <... futex resumed>) = 0 [pid 6277] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6276] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6277] memfd_create("syzkaller", 0) = 3 [pid 6277] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6277] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6277] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6277] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6277] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6277] close(3) = 0 [pid 6277] mkdir("./bus", 0777) = 0 [pid 6277] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6277] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6277] chdir("./bus") = 0 [pid 6277] ioctl(4, LOOP_CLR_FD) = 0 [pid 6277] close(4) = 0 [pid 6277] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6276] <... futex resumed>) = 0 [pid 6277] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6276] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6277] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6276] <... futex resumed>) = 0 [pid 6277] memfd_create("syzkaller", 0 [pid 6276] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6277] <... memfd_create resumed>) = 4 [pid 6277] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6277] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6277] munmap(0x7f6d360cf000, 32768) = 0 [pid 6277] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6277] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6277] ioctl(5, LOOP_CLR_FD) = 0 [pid 6277] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6277] close(5) = 0 [pid 6277] close(4) = 0 [pid 6277] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6276] <... futex resumed>) = 0 [pid 6277] <... futex resumed>) = 1 [pid 6276] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6277] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6276] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6277] <... openat resumed>) = 4 [pid 6277] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6276] <... futex resumed>) = 0 [pid 6276] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6276] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6277] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6277] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6276] <... futex resumed>) = 0 [pid 6276] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6276] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6277] <... futex resumed>) = 1 [pid 6277] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6277] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6276] <... futex resumed>) = 0 [pid 6276] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6276] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6277] <... futex resumed>) = 1 [pid 6277] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6277] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6277] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6276] <... futex resumed>) = 0 [pid 6276] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6276] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6276] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6276] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6276] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6276] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6278 attached => {parent_tid=[6278]}, 88) = 6278 [pid 6276] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6276] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6276] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6277] <... futex resumed>) = 1 [pid 6277] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6277] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6278] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6277] <... openat resumed>) = 6 [pid 6277] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6277] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6278] <... rseq resumed>) = 0 [pid 6278] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6278] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 133.858149][ T6277] loop0: detected capacity change from 0 to 64 [pid 6278] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6278] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6276] <... futex resumed>) = 0 [pid 6278] <... futex resumed>) = 1 [pid 6278] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6276] exit_group(0) = ? [pid 6278] <... futex resumed>) = ? [pid 6277] <... futex resumed>) = ? [pid 6278] +++ exited with 0 +++ [pid 6277] +++ exited with 0 +++ [pid 6276] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6276, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./410", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./410", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./410/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./410/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./410/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./410/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./410/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./410/bus") = 0 umount2("./410/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./410/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./410/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./410") = 0 mkdir("./411", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6279 attached , child_tidptr=0x5555564f6750) = 6279 [pid 6279] set_robust_list(0x5555564f6760, 24) = 0 [pid 6279] chdir("./411") = 0 [pid 6279] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6279] setpgid(0, 0) = 0 [pid 6279] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6279] write(3, "1000", 4) = 4 [pid 6279] close(3) = 0 [pid 6279] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6279] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6279] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6279] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6279] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6279] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6279] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6279] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6280 attached => {parent_tid=[6280]}, 88) = 6280 [pid 6280] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6279] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6279] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6279] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6280] <... rseq resumed>) = 0 [pid 6280] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6280] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6280] memfd_create("syzkaller", 0) = 3 [pid 6280] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6280] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6280] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6280] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6280] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6280] close(3) = 0 [pid 6280] mkdir("./bus", 0777) = 0 [pid 6280] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6280] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6280] chdir("./bus") = 0 [pid 6280] ioctl(4, LOOP_CLR_FD) = 0 [pid 6280] close(4) = 0 [pid 6280] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6279] <... futex resumed>) = 0 [pid 6280] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6279] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6280] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6279] <... futex resumed>) = 0 [pid 6280] memfd_create("syzkaller", 0 [pid 6279] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6280] <... memfd_create resumed>) = 4 [pid 6280] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6280] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6280] munmap(0x7f6d360cf000, 32768) = 0 [pid 6280] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6280] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6280] ioctl(5, LOOP_CLR_FD) = 0 [pid 6280] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6280] close(5) = 0 [pid 6280] close(4) = 0 [pid 6280] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6279] <... futex resumed>) = 0 [pid 6279] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6279] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6280] <... futex resumed>) = 1 [pid 6280] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6280] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6279] <... futex resumed>) = 0 [pid 6279] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6279] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6280] <... futex resumed>) = 1 [pid 6280] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6280] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6279] <... futex resumed>) = 0 [pid 6279] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6279] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6280] <... futex resumed>) = 1 [pid 6280] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6280] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6279] <... futex resumed>) = 0 [pid 6279] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6280] <... futex resumed>) = 1 [pid 6280] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6279] <... futex resumed>) = 0 [pid 6280] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6279] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6280] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6279] <... futex resumed>) = 0 [pid 6279] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6279] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6279] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6279] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6280] <... futex resumed>) = 1 [pid 6280] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6280] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6279] <... mprotect resumed>) = 0 [pid 6280] <... openat resumed>) = 6 [pid 6279] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6279] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6281 attached [pid 6281] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6281] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6280] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6279] <... clone3 resumed> => {parent_tid=[6281]}, 88) = 6281 [pid 6281] rt_sigprocmask(SIG_SETMASK, [], [pid 6280] <... futex resumed>) = 0 [pid 6279] rt_sigprocmask(SIG_SETMASK, [], [pid 6281] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6280] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6279] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6281] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6279] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6281] <... futex resumed>) = 0 [pid 6281] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6279] <... futex resumed>) = 1 [pid 6279] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6281] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6281] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6279] <... futex resumed>) = 0 [pid 6281] <... futex resumed>) = 1 [pid 6279] exit_group(0 [pid 6281] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL) = ? [pid 6280] <... futex resumed>) = ? [pid 6279] <... exit_group resumed>) = ? [pid 6281] +++ exited with 0 +++ [pid 6280] +++ exited with 0 +++ [ 133.993009][ T6280] loop0: detected capacity change from 0 to 64 [pid 6279] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6279, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./411", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./411", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./411/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./411/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./411/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./411/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./411/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./411/bus") = 0 umount2("./411/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./411/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./411/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./411") = 0 mkdir("./412", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6282 attached , child_tidptr=0x5555564f6750) = 6282 [pid 6282] set_robust_list(0x5555564f6760, 24) = 0 [pid 6282] chdir("./412") = 0 [pid 6282] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6282] setpgid(0, 0) = 0 [pid 6282] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6282] write(3, "1000", 4) = 4 [pid 6282] close(3) = 0 [pid 6282] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6282] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6282] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6282] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6282] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6282] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6282] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6282] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6283 attached => {parent_tid=[6283]}, 88) = 6283 [pid 6283] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6282] rt_sigprocmask(SIG_SETMASK, [], [pid 6283] <... rseq resumed>) = 0 [pid 6283] set_robust_list(0x7f6d468e79a0, 24 [pid 6282] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6283] <... set_robust_list resumed>) = 0 [pid 6282] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6283] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6282] <... futex resumed>) = 0 [pid 6283] memfd_create("syzkaller", 0 [pid 6282] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6283] <... memfd_create resumed>) = 3 [pid 6283] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6283] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6283] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6283] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6283] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6283] close(3) = 0 [pid 6283] mkdir("./bus", 0777) = 0 [pid 6283] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6283] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6283] chdir("./bus") = 0 [pid 6283] ioctl(4, LOOP_CLR_FD) = 0 [pid 6283] close(4) = 0 [pid 6283] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6283] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6282] <... futex resumed>) = 0 [pid 6282] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6283] <... futex resumed>) = 0 [pid 6283] memfd_create("syzkaller", 0) = 4 [pid 6283] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6283] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768 [pid 6282] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6283] <... write resumed>) = 32768 [pid 6283] munmap(0x7f6d360cf000, 32768) = 0 [pid 6283] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6283] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6283] ioctl(5, LOOP_CLR_FD) = 0 [pid 6283] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6283] close(5) = 0 [pid 6283] close(4) = 0 [pid 6283] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6282] <... futex resumed>) = 0 [pid 6283] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6282] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6283] <... futex resumed>) = 0 [pid 6282] <... futex resumed>) = 1 [pid 6283] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6282] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6283] <... openat resumed>) = 4 [pid 6283] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6283] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6282] <... futex resumed>) = 0 [pid 6282] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6283] <... futex resumed>) = 0 [pid 6282] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6283] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6283] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6282] <... futex resumed>) = 0 [pid 6283] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6282] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6283] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6282] <... futex resumed>) = 0 [pid 6283] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6282] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6283] <... mmap resumed>) = 0x20000000 [pid 6283] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6282] <... futex resumed>) = 0 [pid 6283] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 6282] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6283] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6283] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6282] <... futex resumed>) = 0 [pid 6282] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6283] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6282] <... futex resumed>) = 0 [pid 6282] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6283] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6282] <... futex resumed>) = 0 [pid 6283] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6282] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6283] <... openat resumed>) = 6 [pid 6282] <... futex resumed>) = 0 [pid 6283] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6283] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6282] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6282] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6282] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6282] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6284 attached => {parent_tid=[6284]}, 88) = 6284 [pid 6284] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6282] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6282] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6284] <... rseq resumed>) = 0 [pid 6284] set_robust_list(0x7f6d360d69a0, 24 [pid 6282] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6284] <... set_robust_list resumed>) = 0 [pid 6284] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6284] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6284] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6282] <... futex resumed>) = 0 [pid 6284] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6282] exit_group(0) = ? [pid 6284] <... futex resumed>) = ? [pid 6284] +++ exited with 0 +++ [pid 6283] <... futex resumed>) = ? [pid 6283] +++ exited with 0 +++ [pid 6282] +++ exited with 0 +++ [ 134.122068][ T6283] loop0: detected capacity change from 0 to 64 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6282, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./412", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./412", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./412/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./412/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./412/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./412/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./412/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./412/bus") = 0 umount2("./412/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./412/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./412/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./412") = 0 mkdir("./413", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6285 attached , child_tidptr=0x5555564f6750) = 6285 [pid 6285] set_robust_list(0x5555564f6760, 24) = 0 [pid 6285] chdir("./413") = 0 [pid 6285] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6285] setpgid(0, 0) = 0 [pid 6285] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6285] write(3, "1000", 4) = 4 [pid 6285] close(3) = 0 [pid 6285] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6285] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6285] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6285] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6285] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6285] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6285] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6285] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6286 attached [pid 6286] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6285] <... clone3 resumed> => {parent_tid=[6286]}, 88) = 6286 [pid 6286] <... rseq resumed>) = 0 [pid 6286] set_robust_list(0x7f6d468e79a0, 24 [pid 6285] rt_sigprocmask(SIG_SETMASK, [], [pid 6286] <... set_robust_list resumed>) = 0 [pid 6285] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6286] rt_sigprocmask(SIG_SETMASK, [], [pid 6285] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6286] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6285] <... futex resumed>) = 0 [pid 6286] memfd_create("syzkaller", 0 [pid 6285] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6286] <... memfd_create resumed>) = 3 [pid 6286] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6286] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6286] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6286] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6286] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6286] close(3) = 0 [pid 6286] mkdir("./bus", 0777) = 0 [pid 6286] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6286] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6286] chdir("./bus") = 0 [pid 6286] ioctl(4, LOOP_CLR_FD) = 0 [pid 6286] close(4) = 0 [pid 6286] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6285] <... futex resumed>) = 0 [pid 6285] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6286] memfd_create("syzkaller", 0 [pid 6285] <... futex resumed>) = 0 [pid 6286] <... memfd_create resumed>) = 4 [pid 6285] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6286] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6286] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6286] munmap(0x7f6d360cf000, 32768) = 0 [pid 6286] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6286] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6286] ioctl(5, LOOP_CLR_FD) = 0 [pid 6286] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6286] close(5) = 0 [pid 6286] close(4) = 0 [pid 6286] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6285] <... futex resumed>) = 0 [pid 6285] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6286] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6285] <... futex resumed>) = 0 [pid 6285] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6286] <... openat resumed>) = 4 [pid 6286] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6285] <... futex resumed>) = 0 [pid 6286] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6285] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6286] <... write resumed>) = 12288 [pid 6285] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6286] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6285] <... futex resumed>) = 0 [pid 6286] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6285] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6286] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6285] <... futex resumed>) = 0 [pid 6286] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6285] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6286] <... mmap resumed>) = 0x20000000 [pid 6286] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6285] <... futex resumed>) = 0 [pid 6285] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6286] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6285] <... futex resumed>) = 0 [pid 6285] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6286] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6286] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6285] <... futex resumed>) = 0 [pid 6285] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6286] <... futex resumed>) = 1 [pid 6285] <... futex resumed>) = 0 [pid 6286] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6285] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6286] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6285] <... futex resumed>) = 0 [pid 6285] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6286] <... openat resumed>) = 6 [pid 6285] <... mmap resumed>) = 0x7f6d360b6000 [pid 6285] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [ 134.251597][ T6286] loop0: detected capacity change from 0 to 64 [pid 6286] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6285] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6286] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6285] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6285] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6287 attached => {parent_tid=[6287]}, 88) = 6287 [pid 6285] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6287] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6285] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6287] <... rseq resumed>) = 0 [pid 6287] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6287] rt_sigprocmask(SIG_SETMASK, [], [pid 6285] <... futex resumed>) = 0 [pid 6287] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6285] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6287] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6287] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6285] <... futex resumed>) = 0 [pid 6287] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6285] exit_group(0 [pid 6287] <... futex resumed>) = ? [pid 6286] <... futex resumed>) = ? [pid 6285] <... exit_group resumed>) = ? [pid 6287] +++ exited with 0 +++ [pid 6286] +++ exited with 0 +++ [pid 6285] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6285, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./413", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./413", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./413/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./413/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./413/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./413/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./413/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./413/bus") = 0 umount2("./413/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./413/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./413/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./413") = 0 mkdir("./414", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6288 attached [pid 6288] set_robust_list(0x5555564f6760, 24) = 0 [pid 6288] chdir("./414" [pid 5037] <... clone resumed>, child_tidptr=0x5555564f6750) = 6288 [pid 6288] <... chdir resumed>) = 0 [pid 6288] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6288] setpgid(0, 0) = 0 [pid 6288] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6288] write(3, "1000", 4) = 4 [pid 6288] close(3) = 0 [pid 6288] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6288] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6288] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6288] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6288] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6288] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6288] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6288] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6289 attached [pid 6289] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6288] <... clone3 resumed> => {parent_tid=[6289]}, 88) = 6289 [pid 6289] <... rseq resumed>) = 0 [pid 6288] rt_sigprocmask(SIG_SETMASK, [], [pid 6289] set_robust_list(0x7f6d468e79a0, 24 [pid 6288] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6289] <... set_robust_list resumed>) = 0 [pid 6288] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6289] rt_sigprocmask(SIG_SETMASK, [], [pid 6288] <... futex resumed>) = 0 [pid 6289] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6288] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6289] memfd_create("syzkaller", 0) = 3 [pid 6289] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6289] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6289] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6289] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6289] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6289] close(3) = 0 [pid 6289] mkdir("./bus", 0777) = 0 [pid 6289] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6289] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6289] chdir("./bus") = 0 [pid 6289] ioctl(4, LOOP_CLR_FD) = 0 [pid 6289] close(4) = 0 [pid 6289] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6289] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6288] <... futex resumed>) = 0 [pid 6288] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6289] <... futex resumed>) = 0 [pid 6289] memfd_create("syzkaller", 0) = 4 [pid 6289] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6288] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6289] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6289] munmap(0x7f6d360cf000, 32768) = 0 [pid 6289] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6289] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6289] ioctl(5, LOOP_CLR_FD) = 0 [pid 6289] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6289] close(5) = 0 [pid 6289] close(4) = 0 [pid 6289] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6289] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6288] <... futex resumed>) = 0 [pid 6288] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6289] <... futex resumed>) = 0 [pid 6288] <... futex resumed>) = 1 [pid 6289] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6288] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6289] <... openat resumed>) = 4 [pid 6289] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6288] <... futex resumed>) = 0 [pid 6288] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6289] <... futex resumed>) = 1 [pid 6288] <... futex resumed>) = 0 [pid 6289] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6288] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6289] <... write resumed>) = 12288 [pid 6289] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6288] <... futex resumed>) = 0 [pid 6289] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6288] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6288] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6289] <... mmap resumed>) = 0x20000000 [pid 6289] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6288] <... futex resumed>) = 0 [pid 6288] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6289] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6288] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6289] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [ 134.384722][ T6289] loop0: detected capacity change from 0 to 64 [pid 6289] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6288] <... futex resumed>) = 0 [pid 6288] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6288] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6288] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6288] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6289] <... futex resumed>) = 1 [pid 6289] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6288] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6289] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6288] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6289] <... openat resumed>) = 6 [pid 6288] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6290 attached [pid 6289] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6288] <... clone3 resumed> => {parent_tid=[6290]}, 88) = 6290 [pid 6289] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6288] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6288] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6288] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6290] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6290] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6290] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6290] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6290] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6288] <... futex resumed>) = 0 [pid 6290] <... futex resumed>) = 1 [pid 6288] exit_group(0 [pid 6290] ???( [pid 6288] <... exit_group resumed>) = ? [pid 6290] <... ??? resumed>) = ? [pid 6289] <... futex resumed>) = ? [pid 6289] +++ exited with 0 +++ [pid 6290] +++ exited with 0 +++ [pid 6288] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6288, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./414", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./414", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./414/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./414/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./414/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./414/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./414/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./414/bus") = 0 umount2("./414/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./414/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./414/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./414") = 0 mkdir("./415", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6291 attached , child_tidptr=0x5555564f6750) = 6291 [pid 6291] set_robust_list(0x5555564f6760, 24) = 0 [pid 6291] chdir("./415") = 0 [pid 6291] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6291] setpgid(0, 0) = 0 [pid 6291] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6291] write(3, "1000", 4) = 4 [pid 6291] close(3) = 0 [pid 6291] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6291] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6291] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6291] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6291] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6291] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6291] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6291] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6292 attached => {parent_tid=[6292]}, 88) = 6292 [pid 6292] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6292] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6291] rt_sigprocmask(SIG_SETMASK, [], [pid 6292] rt_sigprocmask(SIG_SETMASK, [], [pid 6291] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6292] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6291] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6292] memfd_create("syzkaller", 0 [pid 6291] <... futex resumed>) = 0 [pid 6291] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6292] <... memfd_create resumed>) = 3 [pid 6292] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6292] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6292] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6292] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6292] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6292] close(3) = 0 [pid 6292] mkdir("./bus", 0777) = 0 [pid 6292] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6292] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6292] chdir("./bus") = 0 [pid 6292] ioctl(4, LOOP_CLR_FD) = 0 [pid 6292] close(4) = 0 [pid 6292] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6292] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6291] <... futex resumed>) = 0 [pid 6291] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6292] <... futex resumed>) = 0 [pid 6292] memfd_create("syzkaller", 0 [pid 6291] <... futex resumed>) = 1 [pid 6292] <... memfd_create resumed>) = 4 [pid 6291] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6292] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6292] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6292] munmap(0x7f6d360cf000, 32768) = 0 [pid 6292] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6292] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6292] ioctl(5, LOOP_CLR_FD) = 0 [pid 6292] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6292] close(5) = 0 [pid 6292] close(4) = 0 [pid 6292] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6291] <... futex resumed>) = 0 [pid 6292] <... futex resumed>) = 1 [pid 6291] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6292] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6291] <... futex resumed>) = 0 [pid 6292] <... openat resumed>) = 4 [pid 6291] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6292] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6291] <... futex resumed>) = 0 [pid 6291] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6291] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6292] <... futex resumed>) = 1 [pid 6292] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6292] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6291] <... futex resumed>) = 0 [pid 6291] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6291] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6292] <... futex resumed>) = 1 [pid 6292] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6292] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6291] <... futex resumed>) = 0 [pid 6292] <... futex resumed>) = 1 [pid 6291] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6292] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6291] <... futex resumed>) = 0 [pid 6292] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6291] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6292] <... openat resumed>) = 5 [pid 6292] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6291] <... futex resumed>) = 0 [pid 6291] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6291] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6292] <... futex resumed>) = 1 [pid 6291] <... futex resumed>) = 0 [pid 6292] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6291] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6292] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [pid 6291] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6291] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6292] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6292] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6291] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6293 attached [pid 6293] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6291] <... clone3 resumed> => {parent_tid=[6293]}, 88) = 6293 [ 134.537783][ T6292] loop0: detected capacity change from 0 to 64 [pid 6293] <... rseq resumed>) = 0 [pid 6291] rt_sigprocmask(SIG_SETMASK, [], [pid 6293] set_robust_list(0x7f6d360d69a0, 24 [pid 6291] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6293] <... set_robust_list resumed>) = 0 [pid 6291] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6293] rt_sigprocmask(SIG_SETMASK, [], [pid 6291] <... futex resumed>) = 0 [pid 6293] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6291] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6293] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6293] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6291] <... futex resumed>) = 0 [pid 6293] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6291] exit_group(0 [pid 6293] <... futex resumed>) = ? [pid 6292] <... futex resumed>) = ? [pid 6291] <... exit_group resumed>) = ? [pid 6293] +++ exited with 0 +++ [pid 6292] +++ exited with 0 +++ [pid 6291] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6291, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- umount2("./415", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./415", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./415/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./415/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./415/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./415/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./415/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./415/bus") = 0 umount2("./415/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./415/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./415/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./415") = 0 mkdir("./416", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6294 ./strace-static-x86_64: Process 6294 attached [pid 6294] set_robust_list(0x5555564f6760, 24) = 0 [pid 6294] chdir("./416") = 0 [pid 6294] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6294] setpgid(0, 0) = 0 [pid 6294] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6294] write(3, "1000", 4) = 4 [pid 6294] close(3) = 0 [pid 6294] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6294] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6294] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6294] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6294] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6294] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6294] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6294] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6295 attached => {parent_tid=[6295]}, 88) = 6295 [pid 6295] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6294] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6294] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6294] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6295] <... rseq resumed>) = 0 [pid 6295] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6295] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6295] memfd_create("syzkaller", 0) = 3 [pid 6295] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6295] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6295] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6295] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6295] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6295] close(3) = 0 [pid 6295] mkdir("./bus", 0777) = 0 [pid 6295] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6295] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6295] chdir("./bus") = 0 [pid 6295] ioctl(4, LOOP_CLR_FD) = 0 [pid 6295] close(4) = 0 [pid 6295] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6294] <... futex resumed>) = 0 [pid 6294] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6294] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6295] memfd_create("syzkaller", 0) = 4 [pid 6295] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6295] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6295] munmap(0x7f6d360cf000, 32768) = 0 [pid 6295] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6295] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6295] ioctl(5, LOOP_CLR_FD) = 0 [pid 6295] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6295] close(5) = 0 [pid 6295] close(4) = 0 [pid 6295] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6294] <... futex resumed>) = 0 [pid 6294] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6295] <... futex resumed>) = 1 [pid 6294] <... futex resumed>) = 0 [pid 6295] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6294] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6295] <... openat resumed>) = 4 [pid 6295] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6294] <... futex resumed>) = 0 [pid 6294] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6294] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6295] <... futex resumed>) = 1 [pid 6295] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [ 134.680282][ T6295] loop0: detected capacity change from 0 to 64 [pid 6295] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6294] <... futex resumed>) = 0 [pid 6294] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6294] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6295] <... futex resumed>) = 1 [pid 6295] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6295] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6294] <... futex resumed>) = 0 [pid 6295] <... futex resumed>) = 1 [pid 6294] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6295] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6295] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000 [pid 6294] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6295] <... openat resumed>) = 5 [pid 6295] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6294] <... futex resumed>) = 0 [pid 6295] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6294] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6295] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6294] <... futex resumed>) = 0 [pid 6295] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6294] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6295] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6294] <... futex resumed>) = 0 [pid 6294] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6295] <... openat resumed>) = 6 [pid 6294] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6295] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6295] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6294] <... mprotect resumed>) = 0 [pid 6294] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6294] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} => {parent_tid=[6296]}, 88) = 6296 ./strace-static-x86_64: Process 6296 attached [pid 6294] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6294] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6294] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6296] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6296] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6296] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6296] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6296] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6294] <... futex resumed>) = 0 [pid 6296] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6294] exit_group(0) = ? [pid 6296] <... futex resumed>) = ? [pid 6296] +++ exited with 0 +++ [pid 6295] <... futex resumed>) = ? [pid 6295] +++ exited with 0 +++ [pid 6294] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6294, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- umount2("./416", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./416", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./416/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./416/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./416/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./416/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./416/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./416/bus") = 0 umount2("./416/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./416/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./416/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./416") = 0 mkdir("./417", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6297 attached , child_tidptr=0x5555564f6750) = 6297 [pid 6297] set_robust_list(0x5555564f6760, 24) = 0 [pid 6297] chdir("./417") = 0 [pid 6297] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6297] setpgid(0, 0) = 0 [pid 6297] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6297] write(3, "1000", 4) = 4 [pid 6297] close(3) = 0 [pid 6297] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6297] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6297] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6297] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6297] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6297] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6297] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6297] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0} => {parent_tid=[6298]}, 88) = 6298 [pid 6297] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6297] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6297] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000}./strace-static-x86_64: Process 6298 attached [pid 6298] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6298] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6298] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6298] memfd_create("syzkaller", 0) = 3 [pid 6298] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6298] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6298] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6298] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6298] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6298] close(3) = 0 [pid 6298] mkdir("./bus", 0777) = 0 [pid 6298] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6298] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6298] chdir("./bus") = 0 [pid 6298] ioctl(4, LOOP_CLR_FD) = 0 [pid 6298] close(4) = 0 [pid 6298] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6297] <... futex resumed>) = 0 [pid 6298] <... futex resumed>) = 1 [pid 6297] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6298] memfd_create("syzkaller", 0 [pid 6297] <... futex resumed>) = 0 [pid 6298] <... memfd_create resumed>) = 4 [pid 6297] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6298] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6298] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6298] munmap(0x7f6d360cf000, 32768) = 0 [pid 6298] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6298] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6298] ioctl(5, LOOP_CLR_FD) = 0 [pid 6298] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6298] close(5) = 0 [pid 6298] close(4) = 0 [pid 6298] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6297] <... futex resumed>) = 0 [pid 6298] <... futex resumed>) = 1 [pid 6297] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6298] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6297] <... futex resumed>) = 0 [pid 6298] <... openat resumed>) = 4 [pid 6297] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6298] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6297] <... futex resumed>) = 0 [pid 6297] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6297] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6298] <... futex resumed>) = 1 [pid 6298] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6298] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6297] <... futex resumed>) = 0 [pid 6297] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6298] <... futex resumed>) = 1 [pid 6297] <... futex resumed>) = 0 [pid 6298] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6297] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6298] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6297] <... futex resumed>) = 0 [pid 6297] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6298] <... futex resumed>) = 1 [pid 6297] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6298] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6298] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6298] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6297] <... futex resumed>) = 0 [pid 6297] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6298] <... futex resumed>) = 1 [pid 6298] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6297] <... futex resumed>) = 0 [ 134.828916][ T6298] loop0: detected capacity change from 0 to 64 [pid 6297] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6298] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6297] <... futex resumed>) = 0 [pid 6298] <... openat resumed>) = 6 [pid 6298] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6297] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6298] <... futex resumed>) = 0 [pid 6297] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6298] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6297] <... mprotect resumed>) = 0 [pid 6297] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6297] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6299 attached => {parent_tid=[6299]}, 88) = 6299 [pid 6299] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6297] rt_sigprocmask(SIG_SETMASK, [], [pid 6299] <... rseq resumed>) = 0 [pid 6297] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6299] set_robust_list(0x7f6d360d69a0, 24 [pid 6297] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6299] <... set_robust_list resumed>) = 0 [pid 6297] <... futex resumed>) = 0 [pid 6299] rt_sigprocmask(SIG_SETMASK, [], [pid 6297] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6299] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6299] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6299] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6299] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6297] <... futex resumed>) = 0 [pid 6297] exit_group(0) = ? [pid 6299] <... futex resumed>) = ? [pid 6299] +++ exited with 0 +++ [pid 6298] <... futex resumed>) = ? [pid 6298] +++ exited with 0 +++ [pid 6297] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6297, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./417", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./417", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./417/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./417/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./417/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./417/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./417/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./417/bus") = 0 umount2("./417/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./417/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./417/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./417") = 0 mkdir("./418", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6300 attached , child_tidptr=0x5555564f6750) = 6300 [pid 6300] set_robust_list(0x5555564f6760, 24) = 0 [pid 6300] chdir("./418") = 0 [pid 6300] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6300] setpgid(0, 0) = 0 [pid 6300] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6300] write(3, "1000", 4) = 4 [pid 6300] close(3) = 0 [pid 6300] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6300] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6300] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6300] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6300] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6300] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6300] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6301 attached => {parent_tid=[6301]}, 88) = 6301 [pid 6300] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6300] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6301] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6300] <... futex resumed>) = 0 [pid 6301] <... rseq resumed>) = 0 [pid 6301] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6300] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6301] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6301] memfd_create("syzkaller", 0) = 3 [pid 6301] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6301] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6301] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6301] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6301] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6301] close(3) = 0 [pid 6301] mkdir("./bus", 0777) = 0 [pid 6301] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6301] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6301] chdir("./bus") = 0 [pid 6301] ioctl(4, LOOP_CLR_FD) = 0 [pid 6301] close(4) = 0 [pid 6301] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6300] <... futex resumed>) = 0 [pid 6301] <... futex resumed>) = 1 [pid 6300] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6301] memfd_create("syzkaller", 0 [pid 6300] <... futex resumed>) = 0 [pid 6301] <... memfd_create resumed>) = 4 [pid 6300] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6301] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6301] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6301] munmap(0x7f6d360cf000, 32768) = 0 [pid 6301] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6301] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6301] ioctl(5, LOOP_CLR_FD) = 0 [pid 6301] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6301] close(5) = 0 [pid 6301] close(4) = 0 [pid 6301] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6300] <... futex resumed>) = 0 [pid 6300] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6301] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6300] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6301] <... openat resumed>) = 4 [pid 6301] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6300] <... futex resumed>) = 0 [pid 6301] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL) = -1 EAGAIN (Resource temporarily unavailable) [pid 6300] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6301] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6300] <... futex resumed>) = 0 [pid 6301] <... write resumed>) = 12288 [pid 6300] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6301] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6300] <... futex resumed>) = 0 [pid 6301] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6300] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6301] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6300] <... futex resumed>) = 0 [pid 6301] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6300] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6301] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6300] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6300] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6301] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6300] <... futex resumed>) = 0 [pid 6301] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6300] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6301] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6300] <... futex resumed>) = 0 [pid 6301] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6300] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6301] <... futex resumed>) = 0 [pid 6300] <... futex resumed>) = 1 [pid 6301] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6300] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6301] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6300] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6301] <... openat resumed>) = 6 [pid 6300] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6300] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} => {parent_tid=[6302]}, 88) = 6302 ./strace-static-x86_64: Process 6302 attached [pid 6300] rt_sigprocmask(SIG_SETMASK, [], [pid 6302] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6301] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6300] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6302] <... rseq resumed>) = 0 [pid 6300] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6302] set_robust_list(0x7f6d360d69a0, 24 [pid 6301] <... futex resumed>) = 0 [pid 6302] <... set_robust_list resumed>) = 0 [ 134.972895][ T6301] loop0: detected capacity change from 0 to 64 [pid 6302] rt_sigprocmask(SIG_SETMASK, [], [pid 6301] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6300] <... futex resumed>) = 0 [pid 6302] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6300] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6302] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6302] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6300] <... futex resumed>) = 0 [pid 6302] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6300] exit_group(0 [pid 6302] <... futex resumed>) = ? [pid 6301] <... futex resumed>) = ? [pid 6300] <... exit_group resumed>) = ? [pid 6301] +++ exited with 0 +++ [pid 6302] +++ exited with 0 +++ [pid 6300] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6300, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- umount2("./418", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./418", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./418/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./418/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./418/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./418/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./418/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./418/bus") = 0 umount2("./418/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./418/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./418/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./418") = 0 mkdir("./419", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6303 attached , child_tidptr=0x5555564f6750) = 6303 [pid 6303] set_robust_list(0x5555564f6760, 24) = 0 [pid 6303] chdir("./419") = 0 [pid 6303] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6303] setpgid(0, 0) = 0 [pid 6303] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6303] write(3, "1000", 4) = 4 [pid 6303] close(3) = 0 [pid 6303] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6303] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6303] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6303] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6303] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6303] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6303] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6303] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6304 attached => {parent_tid=[6304]}, 88) = 6304 [pid 6304] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6303] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6303] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6304] <... rseq resumed>) = 0 [pid 6304] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6304] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6304] memfd_create("syzkaller", 0) = 3 [pid 6304] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6304] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6304] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6304] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6304] close(3) = 0 [pid 6304] mkdir("./bus", 0777) = 0 [pid 6304] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6304] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6304] chdir("./bus") = 0 [pid 6304] ioctl(4, LOOP_CLR_FD) = 0 [pid 6304] close(4) = 0 [pid 6304] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6304] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6303] <... futex resumed>) = 0 [pid 6303] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6304] <... futex resumed>) = 0 [pid 6303] <... futex resumed>) = 1 [pid 6304] memfd_create("syzkaller", 0 [pid 6303] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6304] <... memfd_create resumed>) = 4 [pid 6304] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6304] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6304] munmap(0x7f6d360cf000, 32768) = 0 [pid 6304] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6304] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6304] ioctl(5, LOOP_CLR_FD) = 0 [pid 6304] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6304] close(5) = 0 [pid 6304] close(4) = 0 [pid 6304] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6303] <... futex resumed>) = 0 [pid 6303] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6303] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6304] <... futex resumed>) = 1 [pid 6304] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6304] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6303] <... futex resumed>) = 0 [pid 6304] <... futex resumed>) = 1 [pid 6303] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6303] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6304] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6304] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6303] <... futex resumed>) = 0 [pid 6304] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6303] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6304] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6303] <... futex resumed>) = 0 [pid 6304] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6303] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6304] <... mmap resumed>) = 0x20000000 [pid 6304] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6303] <... futex resumed>) = 0 [pid 6304] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6303] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6304] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6303] <... futex resumed>) = 0 [pid 6303] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6304] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6304] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6304] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6303] <... futex resumed>) = 0 [pid 6303] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6303] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6303] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6303] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6303] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6303] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6305 attached [pid 6305] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6303] <... clone3 resumed> => {parent_tid=[6305]}, 88) = 6305 [pid 6303] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6303] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6304] <... futex resumed>) = 1 [pid 6303] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6305] <... rseq resumed>) = 0 [pid 6304] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6304] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [pid 6304] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6304] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6305] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6305] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6305] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6305] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6303] <... futex resumed>) = 0 [pid 6305] <... futex resumed>) = 1 [pid 6305] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6303] exit_group(0) = ? [pid 6305] <... futex resumed>) = ? [ 135.123988][ T6304] loop0: detected capacity change from 0 to 64 [pid 6304] <... futex resumed>) = ? [pid 6305] +++ exited with 0 +++ [pid 6304] +++ exited with 0 +++ [pid 6303] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6303, si_uid=0, si_status=0, si_utime=0, si_stime=4 /* 0.04 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./419", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./419", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./419/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./419/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./419/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./419/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./419/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./419/bus") = 0 umount2("./419/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./419/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./419/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./419") = 0 mkdir("./420", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6306 attached , child_tidptr=0x5555564f6750) = 6306 [pid 6306] set_robust_list(0x5555564f6760, 24) = 0 [pid 6306] chdir("./420") = 0 [pid 6306] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6306] setpgid(0, 0) = 0 [pid 6306] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6306] write(3, "1000", 4) = 4 [pid 6306] close(3) = 0 [pid 6306] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6306] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6306] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6306] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6306] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6306] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6306] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6306] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6307 attached [pid 6307] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053) = 0 [pid 6307] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6306] <... clone3 resumed> => {parent_tid=[6307]}, 88) = 6307 [pid 6307] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6306] rt_sigprocmask(SIG_SETMASK, [], [pid 6307] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6306] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6306] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6307] <... futex resumed>) = 0 [pid 6306] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6307] memfd_create("syzkaller", 0) = 3 [pid 6307] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6307] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6307] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6307] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6307] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6307] close(3) = 0 [pid 6307] mkdir("./bus", 0777) = 0 [pid 6307] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6307] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6307] chdir("./bus") = 0 [pid 6307] ioctl(4, LOOP_CLR_FD) = 0 [pid 6307] close(4) = 0 [pid 6307] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6306] <... futex resumed>) = 0 [pid 6307] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6306] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6307] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6306] <... futex resumed>) = 0 [pid 6307] memfd_create("syzkaller", 0 [pid 6306] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6307] <... memfd_create resumed>) = 4 [pid 6307] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6307] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6307] munmap(0x7f6d360cf000, 32768) = 0 [pid 6307] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6307] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6307] ioctl(5, LOOP_CLR_FD) = 0 [pid 6307] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6307] close(5) = 0 [pid 6307] close(4) = 0 [pid 6307] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6306] <... futex resumed>) = 0 [pid 6307] <... futex resumed>) = 1 [pid 6306] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6307] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6306] <... futex resumed>) = 0 [pid 6307] <... openat resumed>) = 4 [pid 6306] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6307] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6306] <... futex resumed>) = 0 [pid 6306] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6307] <... futex resumed>) = 1 [pid 6306] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6307] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6307] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6306] <... futex resumed>) = 0 [pid 6307] <... futex resumed>) = 1 [pid 6307] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6306] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6307] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6306] <... futex resumed>) = 0 [pid 6307] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6306] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6307] <... mmap resumed>) = 0x20000000 [pid 6307] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6306] <... futex resumed>) = 0 [pid 6306] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6306] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6307] <... futex resumed>) = 1 [pid 6307] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6307] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6307] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6306] <... futex resumed>) = 0 [pid 6306] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6306] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6307] <... futex resumed>) = 1 [pid 6306] <... futex resumed>) = 0 [pid 6307] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6306] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6307] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 6 [pid 6306] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6306] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6307] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6306] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6307] <... futex resumed>) = 0 [pid 6307] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6306] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6308 attached => {parent_tid=[6308]}, 88) = 6308 [pid 6308] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6308] set_robust_list(0x7f6d360d69a0, 24 [pid 6306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6306] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6306] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6308] <... set_robust_list resumed>) = 0 [pid 6308] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6308] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6308] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6306] <... futex resumed>) = 0 [pid 6308] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6306] exit_group(0 [pid 6308] <... futex resumed>) = ? [pid 6308] +++ exited with 0 +++ [pid 6307] <... futex resumed>) = ? [pid 6306] <... exit_group resumed>) = ? [ 135.257004][ T6307] loop0: detected capacity change from 0 to 64 [pid 6307] +++ exited with 0 +++ [pid 6306] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6306, si_uid=0, si_status=0, si_utime=0, si_stime=5 /* 0.05 s */} --- umount2("./420", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./420", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./420/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./420/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./420/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./420/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./420/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./420/bus") = 0 umount2("./420/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./420/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./420/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./420") = 0 mkdir("./421", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6309 attached [pid 6309] set_robust_list(0x5555564f6760, 24) = 0 [pid 5037] <... clone resumed>, child_tidptr=0x5555564f6750) = 6309 [pid 6309] chdir("./421") = 0 [pid 6309] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6309] setpgid(0, 0) = 0 [pid 6309] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6309] write(3, "1000", 4) = 4 [pid 6309] close(3) = 0 [pid 6309] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6309] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6309] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6309] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6309] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6309] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6310 attached [pid 6310] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6309] <... clone3 resumed> => {parent_tid=[6310]}, 88) = 6310 [pid 6310] <... rseq resumed>) = 0 [pid 6309] rt_sigprocmask(SIG_SETMASK, [], [pid 6310] set_robust_list(0x7f6d468e79a0, 24 [pid 6309] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6310] <... set_robust_list resumed>) = 0 [pid 6309] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6310] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6309] <... futex resumed>) = 0 [pid 6310] memfd_create("syzkaller", 0 [pid 6309] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6310] <... memfd_create resumed>) = 3 [pid 6310] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6310] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6310] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6310] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6310] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6310] close(3) = 0 [pid 6310] mkdir("./bus", 0777) = 0 [pid 6310] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6310] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6310] chdir("./bus") = 0 [pid 6310] ioctl(4, LOOP_CLR_FD) = 0 [pid 6310] close(4) = 0 [pid 6310] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6310] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6309] <... futex resumed>) = 0 [pid 6309] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6310] <... futex resumed>) = 0 [pid 6309] <... futex resumed>) = 1 [pid 6310] memfd_create("syzkaller", 0 [pid 6309] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6310] <... memfd_create resumed>) = 4 [pid 6310] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6310] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6310] munmap(0x7f6d360cf000, 32768) = 0 [pid 6310] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6310] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6310] ioctl(5, LOOP_CLR_FD) = 0 [pid 6310] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6310] close(5) = 0 [pid 6310] close(4) = 0 [pid 6310] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6309] <... futex resumed>) = 0 [pid 6310] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6309] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6310] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6310] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6309] <... futex resumed>) = 0 [pid 6309] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6310] <... openat resumed>) = 4 [pid 6310] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6309] <... futex resumed>) = 0 [pid 6309] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6310] <... futex resumed>) = 1 [pid 6309] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6310] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651) = 12288 [pid 6310] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6309] <... futex resumed>) = 0 [pid 6309] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6309] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6310] <... futex resumed>) = 1 [pid 6310] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6310] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6309] <... futex resumed>) = 0 [pid 6309] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6310] <... futex resumed>) = 1 [pid 6310] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [ 135.367278][ T6310] loop0: detected capacity change from 0 to 64 [pid 6309] <... futex resumed>) = 0 [pid 6310] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6309] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6310] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6309] <... futex resumed>) = 0 [pid 6309] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6309] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6310] <... futex resumed>) = 1 [pid 6309] <... mmap resumed>) = 0x7f6d360b6000 [pid 6310] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6310] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6309] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6310] <... openat resumed>) = 6 [pid 6309] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6311 attached [pid 6310] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6309] <... clone3 resumed> => {parent_tid=[6311]}, 88) = 6311 [pid 6311] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6311] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6310] <... futex resumed>) = 0 [pid 6309] rt_sigprocmask(SIG_SETMASK, [], [pid 6310] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6309] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6309] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6311] rt_sigprocmask(SIG_SETMASK, [], [pid 6309] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6311] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6311] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6311] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6311] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6309] <... futex resumed>) = 0 [pid 6309] exit_group(0 [pid 6310] <... futex resumed>) = ? [pid 6311] <... futex resumed>) = ? [pid 6309] <... exit_group resumed>) = ? [pid 6310] +++ exited with 0 +++ [pid 6311] +++ exited with 0 +++ [pid 6309] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6309, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- umount2("./421", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./421", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./421/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./421/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./421/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./421/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./421/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./421/bus") = 0 umount2("./421/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./421/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./421/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./421") = 0 mkdir("./422", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6312 attached , child_tidptr=0x5555564f6750) = 6312 [pid 6312] set_robust_list(0x5555564f6760, 24) = 0 [pid 6312] chdir("./422") = 0 [pid 6312] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6312] setpgid(0, 0) = 0 [pid 6312] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6312] write(3, "1000", 4) = 4 [pid 6312] close(3) = 0 [pid 6312] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6312] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6312] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6312] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6312] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6312] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6312] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6312] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6313 attached [pid 6313] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6312] <... clone3 resumed> => {parent_tid=[6313]}, 88) = 6313 [pid 6313] <... rseq resumed>) = 0 [pid 6312] rt_sigprocmask(SIG_SETMASK, [], [pid 6313] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6312] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6313] rt_sigprocmask(SIG_SETMASK, [], [pid 6312] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6313] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6312] <... futex resumed>) = 0 [pid 6313] memfd_create("syzkaller", 0 [pid 6312] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6313] <... memfd_create resumed>) = 3 [pid 6313] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6313] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6313] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6313] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6313] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6313] close(3) = 0 [pid 6313] mkdir("./bus", 0777) = 0 [pid 6313] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6313] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6313] chdir("./bus") = 0 [pid 6313] ioctl(4, LOOP_CLR_FD) = 0 [pid 6313] close(4) = 0 [pid 6313] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6312] <... futex resumed>) = 0 [pid 6312] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6312] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6313] memfd_create("syzkaller", 0) = 4 [pid 6313] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6313] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6313] munmap(0x7f6d360cf000, 32768) = 0 [pid 6313] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6313] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6313] ioctl(5, LOOP_CLR_FD) = 0 [pid 6313] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6313] close(5) = 0 [pid 6313] close(4) = 0 [pid 6313] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6312] <... futex resumed>) = 0 [pid 6313] <... futex resumed>) = 1 [pid 6313] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6312] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6313] <... openat resumed>) = 4 [pid 6312] <... futex resumed>) = 0 [pid 6313] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6312] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}) = -1 EAGAIN (Resource temporarily unavailable) [pid 6313] <... futex resumed>) = 0 [pid 6312] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6313] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6312] <... futex resumed>) = 0 [pid 6313] <... write resumed>) = 12288 [pid 6312] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6313] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6313] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6312] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6312] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6313] <... futex resumed>) = 0 [pid 6312] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 135.523946][ T6313] loop0: detected capacity change from 0 to 64 [pid 6313] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0) = 0x20000000 [pid 6313] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6312] <... futex resumed>) = 0 [pid 6313] <... futex resumed>) = 1 [pid 6312] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6313] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6312] <... futex resumed>) = 0 [pid 6312] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6313] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6313] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6312] <... futex resumed>) = 0 [pid 6313] <... futex resumed>) = 1 [pid 6312] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6313] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6312] <... futex resumed>) = 0 [pid 6312] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6313] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6312] <... futex resumed>) = 0 [pid 6312] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6313] <... openat resumed>) = 6 [pid 6312] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6313] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6312] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6313] <... futex resumed>) = 0 [pid 6313] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6312] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6312] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} => {parent_tid=[6314]}, 88) = 6314 [pid 6312] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6312] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 6314 attached ) = 0 [pid 6314] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053 [pid 6312] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6314] <... rseq resumed>) = 0 [pid 6314] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6314] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6314] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651) = -1 ENOSPC (No space left on device) [pid 6314] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6312] <... futex resumed>) = 0 [pid 6314] <... futex resumed>) = 1 [pid 6314] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6312] exit_group(0 [pid 6314] <... futex resumed>) = ? [pid 6314] +++ exited with 0 +++ [pid 6313] <... futex resumed>) = ? [pid 6312] <... exit_group resumed>) = ? [pid 6313] +++ exited with 0 +++ [pid 6312] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6312, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./422", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./422", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./422/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./422/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./422/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./422/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./422/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./422/bus") = 0 umount2("./422/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./422/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./422/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./422") = 0 mkdir("./423", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555564f6750) = 6315 ./strace-static-x86_64: Process 6315 attached [pid 6315] set_robust_list(0x5555564f6760, 24) = 0 [pid 6315] chdir("./423") = 0 [pid 6315] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6315] setpgid(0, 0) = 0 [pid 6315] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 6315] write(3, "1000", 4) = 4 [pid 6315] close(3) = 0 [pid 6315] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6315] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6315] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6315] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6315] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6315] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6315] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6315] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6316 attached [pid 6316] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6315] <... clone3 resumed> => {parent_tid=[6316]}, 88) = 6316 [pid 6316] <... rseq resumed>) = 0 [pid 6316] set_robust_list(0x7f6d468e79a0, 24 [pid 6315] rt_sigprocmask(SIG_SETMASK, [], [pid 6316] <... set_robust_list resumed>) = 0 [pid 6315] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6316] rt_sigprocmask(SIG_SETMASK, [], [pid 6315] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6316] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6315] <... futex resumed>) = 0 [pid 6316] memfd_create("syzkaller", 0 [pid 6315] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6316] <... memfd_create resumed>) = 3 [pid 6316] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6316] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6316] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6316] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6316] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6316] close(3) = 0 [pid 6316] mkdir("./bus", 0777) = 0 [pid 6316] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6316] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6316] chdir("./bus") = 0 [pid 6316] ioctl(4, LOOP_CLR_FD) = 0 [pid 6316] close(4) = 0 [pid 6316] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6315] <... futex resumed>) = 0 [pid 6316] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6315] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6316] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6316] memfd_create("syzkaller", 0 [pid 6315] <... futex resumed>) = 0 [pid 6315] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6316] <... memfd_create resumed>) = 4 [pid 6316] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6316] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6316] munmap(0x7f6d360cf000, 32768) = 0 [pid 6316] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6316] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6316] ioctl(5, LOOP_CLR_FD) = 0 [pid 6316] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6316] close(5) = 0 [pid 6316] close(4) = 0 [pid 6316] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6315] <... futex resumed>) = 0 [pid 6316] <... futex resumed>) = 1 [pid 6315] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6316] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6315] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6316] <... openat resumed>) = 4 [pid 6316] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6315] <... futex resumed>) = 0 [pid 6316] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6315] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6316] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6315] <... futex resumed>) = 0 [pid 6316] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6315] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6316] <... write resumed>) = 12288 [pid 6316] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6315] <... futex resumed>) = 0 [pid 6316] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6315] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6316] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6315] <... futex resumed>) = 0 [pid 6316] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6315] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6316] <... mmap resumed>) = 0x20000000 [pid 6316] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6315] <... futex resumed>) = 0 [pid 6316] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6315] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6316] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6315] <... futex resumed>) = 0 [pid 6316] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [pid 6315] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6316] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6316] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6316] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6315] <... futex resumed>) = 0 [pid 6315] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6316] <... futex resumed>) = 0 [pid 6315] <... futex resumed>) = 1 [pid 6316] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6315] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6316] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6315] <... futex resumed>) = 0 [pid 6315] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d360b6000 [pid 6316] <... openat resumed>) = 6 [pid 6315] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6316] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6315] <... mprotect resumed>) = 0 [pid 6315] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6315] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0} [pid 6316] <... futex resumed>) = 0 [pid 6316] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 6317 attached [pid 6315] <... clone3 resumed> => {parent_tid=[6317]}, 88) = 6317 [pid 6317] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6317] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [ 135.679735][ T6316] loop0: detected capacity change from 0 to 64 [pid 6315] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6315] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6317] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6315] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6317] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6317] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6317] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6315] <... futex resumed>) = 0 [pid 6315] exit_group(0 [pid 6317] <... futex resumed>) = ? [pid 6317] +++ exited with 0 +++ [pid 6316] <... futex resumed>) = ? [pid 6315] <... exit_group resumed>) = ? [pid 6316] +++ exited with 0 +++ [pid 6315] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6315, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./423", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./423", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./423/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./423/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./423/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./423/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./423/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(4, 0x5555564ff830 /* 2 entries */, 32768) = 48 getdents64(4, 0x5555564ff830 /* 0 entries */, 32768) = 0 close(4) = 0 rmdir("./423/bus") = 0 umount2("./423/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./423/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 unlink("./423/binderfs") = 0 getdents64(3, 0x5555564f77f0 /* 0 entries */, 32768) = 0 close(3) = 0 rmdir("./423") = 0 mkdir("./424", 0777) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) close(3) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 6318 attached [pid 6318] set_robust_list(0x5555564f6760, 24) = 0 [pid 6318] chdir("./424") = 0 [pid 6318] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 6318] setpgid(0, 0) = 0 [pid 6318] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 5037] <... clone resumed>, child_tidptr=0x5555564f6750) = 6318 [pid 6318] <... openat resumed>) = 3 [pid 6318] write(3, "1000", 4) = 4 [pid 6318] close(3) = 0 [pid 6318] symlink("/dev/binderfs", "./binderfs") = 0 [pid 6318] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6318] rt_sigaction(SIGRT_1, {sa_handler=0x7f6d46951950, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f6d468fae10}, NULL, 8) = 0 [pid 6318] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 6318] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f6d468c7000 [pid 6318] mprotect(0x7f6d468c8000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 6318] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 6318] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d468e7990, parent_tid=0x7f6d468e7990, exit_signal=0, stack=0x7f6d468c7000, stack_size=0x20240, tls=0x7f6d468e76c0}./strace-static-x86_64: Process 6319 attached [pid 6319] rseq(0x7f6d468e7fe0, 0x20, 0, 0x53053053 [pid 6318] <... clone3 resumed> => {parent_tid=[6319]}, 88) = 6319 [pid 6319] <... rseq resumed>) = 0 [pid 6319] set_robust_list(0x7f6d468e79a0, 24) = 0 [pid 6319] rt_sigprocmask(SIG_SETMASK, [], [pid 6318] rt_sigprocmask(SIG_SETMASK, [], [pid 6319] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6318] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 6319] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6318] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6319] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6318] <... futex resumed>) = 0 [pid 6319] memfd_create("syzkaller", 0 [pid 6318] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6319] <... memfd_create resumed>) = 3 [pid 6319] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d3e4c7000 [pid 6319] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6319] munmap(0x7f6d3e4c7000, 32768) = 0 [pid 6319] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 6319] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 6319] close(3) = 0 [pid 6319] mkdir("./bus", 0777) = 0 [pid 6319] mount("/dev/loop0", "./bus", "hfs", MS_NOSUID|MS_NOEXEC|MS_DIRSYNC|MS_I_VERSION|MS_STRICTATIME, "file_umask=00000000000000000000001,codepage=iso8859-2,quiet,file_umask=00000000000000000011404,quiet"...) = 0 [pid 6319] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3 [pid 6319] chdir("./bus") = 0 [pid 6319] ioctl(4, LOOP_CLR_FD) = 0 [pid 6319] close(4) = 0 [pid 6319] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6318] <... futex resumed>) = 0 [pid 6318] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6318] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=4, tv_nsec=50000000} [pid 6319] memfd_create("syzkaller", 0) = 4 [pid 6319] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f6d360cf000 [pid 6319] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 32768) = 32768 [pid 6319] munmap(0x7f6d360cf000, 32768) = 0 [pid 6319] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 6319] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6319] ioctl(5, LOOP_CLR_FD) = 0 [pid 6319] ioctl(5, LOOP_SET_FD, 4) = -1 EBUSY (Device or resource busy) [pid 6319] close(5) = 0 [pid 6319] close(4) = 0 [pid 6319] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6318] <... futex resumed>) = 0 [pid 6318] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 6318] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6319] openat(AT_FDCWD, "cpu.stat", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4 [pid 6319] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6318] <... futex resumed>) = 0 [pid 6319] <... futex resumed>) = 1 [pid 6319] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6318] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6319] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6318] <... futex resumed>) = 0 [pid 6319] write(4, "\x74\x00\x00\x65\x3d\x85\xe7\xbc\xb7\x2c\x63\x6f\x64\x65\x70\x61\x67\x65\x3d\x75\x5c\x66\x38\x2c\x69\x6f\x63\x68\x61\x72\x7a\x65\x74\x3d\x63\x70\x38\x37\x34\xb9\x00\x00\x00\x00\x00\x00\x00\x3d\x30\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x65\x57\xee\x7a\xef\x08\xdf\x18\xab\x68\xf7\x86\x28\xae\xb7\xd5\x20\x2c\x00\xff\xaf\xca\xff\x17\x38\xf1\x11\x0f\x46\x6b\x2d\xbd\xb5\x99\xc1"..., 34136651 [pid 6318] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6319] <... write resumed>) = 12288 [pid 6319] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6318] <... futex resumed>) = 0 [pid 6319] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6318] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6319] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6318] <... futex resumed>) = 0 [pid 6319] mmap(0x20000000, 11755520, PROT_READ|0x800000, MAP_SHARED|MAP_FIXED|MAP_POPULATE|MAP_STACK, 4, 0 [pid 6318] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6319] <... mmap resumed>) = 0x20000000 [pid 6319] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6318] <... futex resumed>) = 0 [pid 6319] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6318] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6319] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6318] <... futex resumed>) = 0 [pid 6318] futex(0x7f6d469b46cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6319] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000180} --- [ 135.814454][ T6319] loop0: detected capacity change from 0 to 64 [pid 6319] openat(AT_FDCWD, "\xa8\x3b\xfa\x90\xfa\x02\xcd\xfd\xf7\x27\x9b\xe7\x64\x41\x5e\x3f\x70\xa9\xce\xd9\x1e\x65\xf6\xa2\xcb\x40\xf9\x73\xe2\x03\xb8\x92\xc9\x65\x63\x18\xb6\x96\x43\x93\x9c\x7a\xc3\x47\x94\xcf\x45\x10\xef\xd7\xba\x79\x39\x58\x96\xea\xf1\x6a\x5f\x4c\x5a\xe7\xcb\x7e", O_RDONLY|O_CREAT|O_EXCL|0x30, 000) = 5 [pid 6319] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6318] <... futex resumed>) = 0 [pid 6319] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6318] futex(0x7f6d469b46c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 6319] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 6318] <... futex resumed>) = 0 [pid 6318] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6319] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x20000008} --- [pid 6318] <... futex resumed>) = 0 [pid 6319] openat(AT_FDCWD, "t", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000 [pid 6318] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 6319] <... openat resumed>) = 6 [pid 6318] <... mmap resumed>) = 0x7f6d360b6000 [pid 6318] mprotect(0x7f6d360b7000, 131072, PROT_READ|PROT_WRITE [pid 6319] futex(0x7f6d469b46cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 6318] <... mprotect resumed>) = 0 [pid 6319] <... futex resumed>) = 0 [pid 6318] rt_sigprocmask(SIG_BLOCK, ~[], [pid 6319] futex(0x7f6d469b46c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6318] <... rt_sigprocmask resumed>[], 8) = 0 [pid 6318] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f6d360d6990, parent_tid=0x7f6d360d6990, exit_signal=0, stack=0x7f6d360b6000, stack_size=0x20240, tls=0x7f6d360d66c0}./strace-static-x86_64: Process 6320 attached [pid 6320] rseq(0x7f6d360d6fe0, 0x20, 0, 0x53053053) = 0 [pid 6320] set_robust_list(0x7f6d360d69a0, 24) = 0 [pid 6320] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6320] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6318] <... clone3 resumed> => {parent_tid=[6320]}, 88) = 6320 [pid 6318] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 6318] futex(0x7f6d469b46d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6320] <... futex resumed>) = 0 [pid 6320] write(4, "\x00\x1a\x40\x69\x3c\xa4\xdc\xd4\x2d\xbf\x2a\xde\xf7\x2a\x0f\xe3\x9f\x3a\x28\xc7\xa1\x74\xdf\xb9\x4c\xf1\x7b\xe8\x48\xec\xbc\x33\xf8\x2e\x4e\x7c\xc4\x8b\x42\xef\x9e\x1d\x89\x38\x2b\x06\xd8\x91\x47\x6a\xae\xdd\x87\xf1\x6d\x04\x73\x8c\x8f\x61\x1f\x86\x34\x25\xd2\x8b\xb0\x53\xaa\x8f\xa2\x78\x1f\xe4\x6c\x2a\x76\x4c\x23\x55\xec\x33\x83\xad\x00\x65\x71\x68\x4a\x27\x58\x06\xa3\x69\x36\x60\x13\x1b\xd4\xce"..., 34136651 [pid 6318] futex(0x7f6d469b46dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 6320] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 6320] futex(0x7f6d469b46dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 6318] <... futex resumed>) = 0 [pid 6320] futex(0x7f6d469b46d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 6318] exit_group(0 [pid 6319] <... futex resumed>) = ? [pid 6318] <... exit_group resumed>) = ? [pid 6320] <... futex resumed>) = ? [pid 6319] +++ exited with 0 +++ [pid 6320] +++ exited with 0 +++ [pid 6318] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=6318, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 umount2("./424", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./424", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 getdents64(3, 0x5555564f77f0 /* 4 entries */, 32768) = 104 umount2("./424/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 umount2("./424/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) newfstatat(AT_FDCWD, "./424/bus", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 umount2("./424/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) openat(AT_FDCWD, "./