./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3428298670
<...>
DUID 00:04:e5:d7:6b:3e:19:ba:e5:eb:4b:9e:6a:98:ce:0b:a0:29
forked to background, child pid 4647
[ 40.184998][ T4648] 8021q: adding VLAN 0 to HW filter on device bond0
[ 40.194337][ T4648] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.200' (ECDSA) to the list of known hosts.
execve("./syz-executor3428298670", ["./syz-executor3428298670"], 0x7ffd8bc613c0 /* 10 vars */) = 0
brk(NULL) = 0x555556bf3000
brk(0x555556bf3c40) = 0x555556bf3c40
arch_prctl(ARCH_SET_FS, 0x555556bf3300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3428298670", 4096) = 28
brk(0x555556c14c40) = 0x555556c14c40
brk(0x555556c15000) = 0x555556c15000
mprotect(0x7f6156a67000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
getpid() = 5072
mkdir("./syzkaller.rg0JqI", 0700) = 0
chmod("./syzkaller.rg0JqI", 0777) = 0
chdir("./syzkaller.rg0JqI") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556bf35d0) = 5073
./strace-static-x86_64: Process 5073 attached
[pid 5073] chdir("./0") = 0
[pid 5073] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5073] setpgid(0, 0) = 0
[pid 5073] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5073] write(3, "1000", 4) = 4
[pid 5073] close(3) = 0
[pid 5073] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5073] memfd_create("syzkaller", 0) = 3
[pid 5073] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f614e599000
syzkaller login: [ 61.543983][ T5073] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5073 'syz-executor342'
[pid 5073] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5073] munmap(0x7f614e599000, 16777216) = 0
[pid 5073] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5073] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5073] close(3) = 0
[pid 5073] mkdir("./file1", 0777) = 0
[ 61.807131][ T5073] loop0: detected capacity change from 0 to 32768
[ 61.821963][ T5073] gfs2: fsid=mounts: Trying to join cluster "lock_nolock", "mounts"
[ 61.830155][ T5073] gfs2: fsid=mounts: Now mounting FS (format 1801)...
[ 61.844385][ T5073] gfs2: fsid=mounts.0: journal 0 mapped with 5 extents in 0ms
[ 61.854187][ T1113] gfs2: fsid=mounts.0: jid=0, already locked for use
[ 61.861111][ T1113] gfs2: fsid=mounts.0: jid=0: Looking at journal...
[pid 5073] mount("/dev/loop0", "./file1", "gfs2", MS_RDONLY|MS_SYNCHRONOUS|MS_NODIRATIME|MS_LAZYTIME, "hostdata=:,noacl,quota_quantum=0x000000000000001f,locktable=mounts") = 0
[pid 5073] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid 5073] chdir("./file1") = 0
[pid 5073] ioctl(4, LOOP_CLR_FD) = 0
[pid 5073] close(4) = 0
[pid 5073] fspick(AT_FDCWD, ".", 0) = 4
[ 61.911752][ T1113] gfs2: fsid=mounts.0: jid=0: Journal head lookup took 50ms
[ 61.919771][ T1113] gfs2: fsid=mounts.0: jid=0: Done
[ 61.925441][ T5073] gfs2: fsid=mounts.0: first mount done, others may mount
[pid 5073] fsconfig(4, FSCONFIG_CMD_RECONFIGURE, NULL, NULL, 0) = 0
[pid 5073] exit_group(0) = ?
[pid 5073] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5073, si_uid=0, si_status=0, si_utime=0, si_stime=38 /* 0.38 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x555556bf4620 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./0/binderfs") = 0
[ 62.085132][ T5073] gfs2: fsid=mounts.0: found 1 quota changes
[ 81.487916][ T2494] cfg80211: failed to load regulatory.db
[ 286.286393][ T28] INFO: task syz-executor342:5072 blocked for more than 143 seconds.
[ 286.294612][ T28] Not tainted 6.3.0-rc4-syzkaller-00025-g3a93e40326c8 #0
[ 286.302324][ T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 286.311142][ T28] task:syz-executor342 state:D stack:24760 pid:5072 ppid:5069 flags:0x00004002
[ 286.320542][ T28] Call Trace:
[ 286.323840][ T28]
[ 286.326962][ T28] __schedule+0x173b/0x4630
[ 286.331649][ T28] ? _raw_spin_unlock_irqrestore+0x8f/0x140
[ 286.337788][ T28] ? lockdep_hardirqs_on+0x98/0x140
[ 286.343071][ T28] ? release_firmware_map_entry+0x190/0x190
[ 286.349150][ T28] ? __asan_memset+0x23/0x40
[ 286.353858][ T28] ? mod_timer_pending+0x30/0x30
[ 286.358895][ T28] ? lockdep_softirqs_off+0x420/0x420
[ 286.364307][ T28] ? print_irqtrace_events+0x220/0x220
[ 286.369850][ T28] schedule+0xc3/0x180
[ 286.373994][ T28] schedule_timeout+0x1bd/0x310
[ 286.378906][ T28] ? console_conditional_schedule+0x40/0x40
[ 286.384837][ T28] ? update_process_times+0x1b0/0x1b0
[ 286.390307][ T28] ? prepare_to_wait_event+0x3b2/0x3f0
[ 286.395796][ T28] gfs2_gl_hash_clear+0x1a3/0x310
[ 286.401002][ T28] ? gfs2_jindex_free+0x46c/0x500
[ 286.406064][ T28] ? withdraw_dq+0x250/0x250
[ 286.410731][ T28] ? gfs2_jindex_free+0x499/0x500
[ 286.415777][ T28] ? wake_bit_function+0x220/0x220
[ 286.420952][ T28] ? gfs2_setbit+0x630/0x630
[ 286.425580][ T28] ? gfs2_clear_rgrpd+0x6a0/0x6c0
[ 286.430726][ T28] gfs2_put_super+0x827/0x890
[ 286.435433][ T28] ? gfs2_evict_inode+0x14a0/0x14a0
[ 286.440677][ T28] generic_shutdown_super+0x134/0x340
[ 286.446121][ T28] kill_block_super+0x7e/0xe0
[ 286.450890][ T28] deactivate_locked_super+0xa4/0x110
[ 286.456334][ T28] cleanup_mnt+0x426/0x4c0
[ 286.461131][ T28] ? _raw_spin_unlock_irq+0x23/0x50
[ 286.466419][ T28] task_work_run+0x24a/0x300
[ 286.471098][ T28] ? dput+0x3a1/0x420
[ 286.475126][ T28] ? task_work_cancel+0x2b0/0x2b0
[ 286.480360][ T28] ? __x64_sys_umount+0x126/0x170
[ 286.485452][ T28] ptrace_notify+0x2cd/0x380
[ 286.490191][ T28] ? do_notify_parent+0xf50/0xf50
[ 286.495251][ T28] ? user_path_at_empty+0x12f/0x180
[ 286.500511][ T28] ? __x64_sys_umount+0x126/0x170
[ 286.505559][ T28] ? path_umount+0xea0/0xea0
[ 286.510234][ T28] ? syscall_enter_from_user_mode+0x32/0x230
[ 286.516279][ T28] syscall_exit_to_user_mode+0x157/0x280
[ 286.521931][ T28] do_syscall_64+0x4d/0xc0
[ 286.526478][ T28] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 286.532510][ T28] RIP: 0033:0x7f61569e7d17
[ 286.537018][ T28] RSP: 002b:00007ffcc9f425a8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
[ 286.545479][ T28] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f61569e7d17
[ 286.553569][ T28] RDX: 00007ffcc9f42669 RSI: 000000000000000a RDI: 00007ffcc9f42660
[ 286.561622][ T28] RBP: 00007ffcc9f42660 R08: 00000000ffffffff R09: 00007ffcc9f42440
[ 286.569692][ T28] R10: 0000555556bf4653 R11: 0000000000000202 R12: 00007ffcc9f436d0
[ 286.577721][ T28] R13: 0000555556bf45f0 R14: 00007ffcc9f425d0 R15: 0000000000000001
[ 286.585717][ T28]
[ 286.588819][ T28]
[ 286.588819][ T28] Showing all locks held in the system:
[ 286.596589][ T28] 1 lock held by rcu_tasks_kthre/12:
[ 286.601897][ T28] #0: ffffffff8cf255b0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xd20
[ 286.612577][ T28] 1 lock held by rcu_tasks_trace/13:
[ 286.617914][ T28] #0: ffffffff8cf25db0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xd20
[ 286.628984][ T28] 1 lock held by khungtaskd/28:
[ 286.633856][ T28] #0: ffffffff8cf253e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
[ 286.643313][ T28] 1 lock held by klogd/4424:
[ 286.647992][ T28] #0: ffff8880b993be98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140
[ 286.658104][ T28] 2 locks held by getty/4748:
[ 286.662813][ T28] #0: ffff8880284e9098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
[ 286.672769][ T28] #1: ffffc900015902f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6ab/0x1db0
[ 286.682958][ T28] 1 lock held by syz-executor342/5072:
[ 286.688488][ T28] #0: ffff88802869c0e0 (&type->s_umount_key#43){+.+.}-{3:3}, at: deactivate_super+0xad/0xf0
[ 286.698765][ T28]
[ 286.701086][ T28] =============================================
[ 286.701086][ T28]
[ 286.709550][ T28] NMI backtrace for cpu 0
[ 286.713909][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.3.0-rc4-syzkaller-00025-g3a93e40326c8 #0
[ 286.723706][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
[ 286.733768][ T28] Call Trace:
[ 286.737042][ T28]
[ 286.739970][ T28] dump_stack_lvl+0x1e7/0x2d0
[ 286.744659][ T28] ? nf_tcp_handle_invalid+0x650/0x650
[ 286.750134][ T28] ? panic+0x770/0x770
[ 286.754210][ T28] nmi_cpu_backtrace+0x498/0x4d0
[ 286.759151][ T28] ? vprintk_emit+0x10d/0x1f0
[ 286.763838][ T28] ? nmi_trigger_cpumask_backtrace+0x300/0x300
[ 286.769995][ T28] ? _printk+0xd5/0x120
[ 286.774165][ T28] ? panic+0x770/0x770
[ 286.778242][ T28] ? __wake_up_klogd+0xcc/0x100
[ 286.783103][ T28] ? panic+0x770/0x770
[ 286.787184][ T28] ? wq_watchdog_touch+0x72/0x110
[ 286.792230][ T28] ? arch_trigger_cpumask_backtrace+0x10/0x10
[ 286.798368][ T28] nmi_trigger_cpumask_backtrace+0x187/0x300
[ 286.804361][ T28] watchdog+0xec2/0xf00
[ 286.808561][ T28] kthread+0x270/0x300
[ 286.812636][ T28] ? hungtask_pm_notify+0x90/0x90
[ 286.817668][ T28] ? kthread_blkcg+0xd0/0xd0
[ 286.822267][ T28] ret_from_fork+0x1f/0x30
[ 286.826728][ T28]
[ 286.829897][ T28] Sending NMI from CPU 0 to CPUs 1:
[ 286.835180][ C1] NMI backtrace for cpu 1
[ 286.835191][ C1] CPU: 1 PID: 56 Comm: kworker/u4:4 Not tainted 6.3.0-rc4-syzkaller-00025-g3a93e40326c8 #0
[ 286.835210][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
[ 286.835221][ C1] Workqueue: events_unbound toggle_allocation_gate
[ 286.835243][ C1] RIP: 0010:inat_get_opcode_attribute+0x31/0x50
[ 286.835266][ C1] Code: e8 14 a1 ec f6 89 d8 48 8d 1c 85 20 4a f7 8b 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 04 8b 03 <5b> c3 89 d9 80 e1 07 80 c1 03 38 c1 7c f0 48 89 df e8 69 57 42 f7
[ 286.835280][ C1] RSP: 0018:ffffc90001577670 EFLAGS: 00000246
[ 286.835294][ C1] RAX: 000000000000b000 RBX: ffffffff8bf74dc4 RCX: dffffc0000000000
[ 286.835307][ C1] RDX: 0000000000000000 RSI: 00000000000000e9 RDI: 00000000000000e9
[ 286.835317][ C1] RBP: 00000000000000e9 R08: ffffffff8a9e0df4 R09: ffffc900015779c0
[ 286.835329][ C1] R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90001577a28
[ 286.835342][ C1] R13: ffffffff81df239e R14: dffffc0000000000 R15: ffffc900015779c0
[ 286.835354][ C1] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
[ 286.835369][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 286.835382][ C1] CR2: 000055cfe0c9c680 CR3: 000000000cd30000 CR4: 00000000003506e0
[ 286.835396][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 286.835406][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 286.835417][ C1] Call Trace:
[ 286.835422][ C1]
[ 286.835428][ C1] insn_get_prefixes+0x45a/0x18a0
[ 286.835448][ C1] ? kmem_cache_alloc+0x5f/0x2e0
[ 286.835518][ C1] ? mark_lock+0x9a/0x340
[ 286.835538][ C1] ? __lock_acquire+0x125b/0x1f80
[ 286.835556][ C1] insn_get_opcode+0x1b2/0xa50
[ 286.835584][ C1] insn_get_modrm+0x22e/0x7a0
[ 286.835604][ C1] ? read_lock_is_recursive+0x20/0x20
[ 286.835623][ C1] insn_get_displacement+0x13e/0x980
[ 286.835651][ C1] insn_get_immediate+0x382/0x13d0
[ 286.835671][ C1] ? rcu_is_watching+0x15/0xb0
[ 286.835694][ C1] insn_decode+0x370/0x500
[ 286.835713][ C1] ? kmem_cache_alloc+0x5e/0x2e0
[ 286.835739][ C1] __jump_label_patch+0xe8/0x440
[ 286.835784][ C1] ? kmem_cache_alloc+0x5e/0x2e0
[ 286.835810][ C1] ? arch_jump_label_transform_queue+0xd0/0xd0
[ 286.835829][ C1] ? __mutex_lock_common+0x42d/0x2530
[ 286.835856][ C1] ? kmem_cache_alloc+0x5e/0x2e0
[ 286.835881][ C1] ? kmem_cache_alloc+0x6d/0x2e0
[ 286.835905][ C1] ? kmem_cache_alloc+0x5e/0x2e0
[ 286.835933][ C1] ? mutex_lock_io_nested+0x60/0x60
[ 286.835957][ C1] arch_jump_label_transform_queue+0x4e/0xd0
[ 286.835978][ C1] __jump_label_update+0x177/0x3a0
[ 286.836030][ C1] static_key_disable_cpuslocked+0xce/0x1b0
[ 286.836056][ C1] static_key_disable+0x1a/0x20
[ 286.836079][ C1] toggle_allocation_gate+0x1b8/0x250
[ 286.836097][ C1] ? virt_to_slab+0x2b0/0x2b0
[ 286.836113][ C1] ? print_irqtrace_events+0x220/0x220
[ 286.836128][ C1] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 286.836163][ C1] process_one_work+0x8a0/0x10e0
[ 286.836199][ C1] ? worker_detach_from_pool+0x290/0x290
[ 286.836225][ C1] ? _raw_spin_lock_irqsave+0x120/0x120
[ 286.836251][ C1] ? kthread_data+0x52/0xc0
[ 286.836270][ C1] ? wq_worker_running+0x9b/0x1a0
[ 286.836289][ C1] worker_thread+0xa63/0x1210
[ 286.836312][ C1] ? _raw_spin_unlock_irqrestore+0xdd/0x140
[ 286.836342][ C1] ? _raw_spin_unlock+0x40/0x40
[ 286.836373][ C1] kthread+0x270/0x300
[ 286.836389][ C1] ? pr_cont_work+0x5e0/0x5e0
[ 286.836409][ C1] ? kthread_blkcg+0xd0/0xd0
[ 286.836428][ C1] ret_from_fork+0x1f/0x30
[ 286.836460][ C1]
[ 286.836466][ C1] INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.286 msecs
[ 286.838588][ T28] Kernel panic - not syncing: hung_task: blocked tasks
[ 286.838602][ T28] CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.3.0-rc4-syzkaller-00025-g3a93e40326c8 #0
[ 286.838625][ T28] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
[ 286.838637][ T28] Call Trace:
[ 286.838643][ T28]
[ 286.838651][ T28] dump_stack_lvl+0x1e7/0x2d0
[ 286.838693][ T28] ? nf_tcp_handle_invalid+0x650/0x650
[ 286.838727][ T28] ? panic+0x770/0x770
[ 286.838759][ T28] ? vscnprintf+0x5d/0x80
[ 286.838789][ T28] panic+0x31c/0x770
[ 286.838817][ T28] ? nmi_trigger_cpumask_backtrace+0x233/0x300
[ 286.838841][ T28] ? memcpy_page_flushcache+0x100/0x100
[ 286.838867][ T28] ? arch_trigger_cpumask_backtrace+0x10/0x10
[ 286.838894][ T28] ? nmi_trigger_cpumask_backtrace+0x233/0x300
[ 286.838916][ T28] ? nmi_trigger_cpumask_backtrace+0x2b4/0x300
[ 286.838941][ T28] ? nmi_trigger_cpumask_backtrace+0x2b9/0x300
[ 286.838967][ T28] watchdog+0xf00/0xf00
[ 286.839002][ T28] kthread+0x270/0x300
[ 286.839024][ T28] ? hungtask_pm_notify+0x90/0x90
[ 286.839045][ T28] ? kthread_blkcg+0xd0/0xd0
[ 286.839069][ T28] ret_from_fork+0x1f/0x30
[ 286.839114][ T28]
[ 286.841195][ T28] Kernel Offset: disabled
[ 287.320663][ T28] Rebooting in 86400 seconds..