./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1145439026
<...>
DUID 00:04:7b:a2:e0:73:6b:5f:a9:8e:d4:f6:53:82:b5:31:a7:5e
forked to background, child pid 3209
[ 29.328528][ T3210] 8021q: adding VLAN 0 to HW filter on device bond0
[ 29.338238][ T3210] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.25' (ECDSA) to the list of known hosts.
execve("./syz-executor1145439026", ["./syz-executor1145439026"], 0x7ffdfd746440 /* 10 vars */) = 0
brk(NULL) = 0x55555682e000
brk(0x55555682ec40) = 0x55555682ec40
arch_prctl(ARCH_SET_FS, 0x55555682e300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1145439026", 4096) = 28
brk(0x55555684fc40) = 0x55555684fc40
brk(0x555556850000) = 0x555556850000
mprotect(0x7f8a5abb1000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
getpid() = 3638
mkdir("./syzkaller.P0Iwlg", 0700) = 0
chmod("./syzkaller.P0Iwlg", 0777) = 0
chdir("./syzkaller.P0Iwlg") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55555682e5d0) = 3639
./strace-static-x86_64: Process 3639 attached
[pid 3639] chdir("./0") = 0
[pid 3639] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 3639] setpgid(0, 0) = 0
[pid 3639] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 3639] write(3, "1000", 4) = 4
[pid 3639] close(3) = 0
[pid 3639] symlink("/dev/binderfs", "./binderfs") = 0
[pid 3639] memfd_create("syzkaller", 0) = 3
[pid 3639] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8a52600000
[pid 3639] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 3639] munmap(0x7f8a52600000, 16777216) = 0
[pid 3639] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 3639] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 3639] close(3) = 0
[pid 3639] mkdir("./file0", 0777) = 0
syzkaller login: [ 51.137469][ T3639] loop0: detected capacity change from 0 to 32768
[ 51.148540][ T3639] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop0 scanned by syz-executor114 (3639)
[ 51.167514][ T3639] BTRFS info (device loop0): using xxhash64 (xxhash64-generic) checksum algorithm
[ 51.176973][ T3639] BTRFS info (device loop0): force clearing of disk cache
[ 51.184490][ T3639] BTRFS info (device loop0): setting nodatasum
[ 51.190653][ T3639] BTRFS info (device loop0): allowing degraded mounts
[ 51.197708][ T3639] BTRFS info (device loop0): enabling disk space caching
[ 51.204984][ T3639] BTRFS info (device loop0): disk space caching is enabled
[ 51.227748][ T3639] BTRFS info (device loop0): enabling ssd optimizations
[pid 3639] mount("/dev/loop0", "./file0", "btrfs", MS_NOEXEC|MS_STRICTATIME, "datacow,clear_cache,nodatasum,rescan_uuid_tree,degraded,space_cache=v1,") = 0
[pid 3639] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 3639] chdir("./file0") = 0
[pid 3639] ioctl(4, LOOP_CLR_FD) = 0
[pid 3639] close(4) = 0
[pid 3639] open("./file0", O_RDONLY) = 4
[pid 3639] ioctl(4, BTRFS_IOC_QUOTA_CTL, {cmd=BTRFS_QUOTA_CTL_ENABLE}) = 0
[ 51.235992][ T3639] BTRFS info (device loop0): clearing free space tree
[ 51.242999][ T3639] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[ 51.253470][ T3639] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
[ 51.274527][ T3639] BTRFS info (device loop0): checking UUID tree
[pid 3639] creat("./bus", 000) = 5
[pid 3639] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 3639] write(6, "11", 2) = 2
[ 51.322740][ T51] BTRFS info (device loop0): qgroup scan completed (inconsistency flag cleared)
[ 51.341279][ T3639] FAULT_INJECTION: forcing a failure.
[ 51.341279][ T3639] name failslab, interval 1, probability 0, space 0, times 1
[ 51.354269][ T3639] CPU: 0 PID: 3639 Comm: syz-executor114 Not tainted 6.1.0-rc7-syzkaller-00123-ga4412fdd49dc #0
[ 51.364709][ T3639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 51.374786][ T3639] Call Trace:
[ 51.378083][ T3639]
[ 51.381048][ T3639] dump_stack_lvl+0x1b1/0x28e
[ 51.385766][ T3639] ? nf_tcp_handle_invalid+0x62e/0x62e
[ 51.391247][ T3639] ? panic+0x710/0x710
[ 51.395356][ T3639] should_fail_ex+0x395/0x4c0
[ 51.400059][ T3639] ? ulist_add_merge+0x15f/0x4a0
[ 51.405017][ T3639] should_failslab+0x5/0x20
[ 51.409539][ T3639] __kmem_cache_alloc_node+0x69/0x310
[ 51.414929][ T3639] ? read_lock_is_recursive+0x10/0x10
[ 51.420319][ T3639] ? ulist_add_merge+0x15f/0x4a0
[ 51.425274][ T3639] kmalloc_trace+0x26/0x60
[ 51.429711][ T3639] ulist_add_merge+0x15f/0x4a0
[ 51.434502][ T3639] clear_state_bit+0x147/0x330
[ 51.439304][ T3639] __clear_extent_bit+0x669/0xc60
[ 51.444364][ T3639] clear_record_extent_bits+0x4e/0x80
[ 51.449765][ T3639] __btrfs_qgroup_release_data+0x4b9/0x850
[ 51.455605][ T3639] ? btrfs_qgroup_free_data+0x40/0x40
[ 51.461012][ T3639] ? rcu_read_lock_sched_held+0x87/0x110
[ 51.466684][ T3639] __btrfs_prealloc_file_range+0x5b1/0x1470
[ 51.472640][ T3639] ? btrfs_prealloc_file_range+0x50/0x50
[ 51.479603][ T3639] ? btrfs_reserve_metadata_bytes+0x170/0x170
[ 51.485692][ T3639] ? wake_bit_function+0x240/0x240
[ 51.490832][ T3639] ? qgroup_reserve_data+0x1d7/0x6f0
[ 51.496161][ T3639] ? __bpf_trace_rcu_stall_warning+0x10/0x10
[ 51.502168][ T3639] btrfs_prealloc_file_range+0x3c/0x50
[ 51.507645][ T3639] btrfs_fallocate+0x1ba7/0x2020
[ 51.512589][ T3639] ? btrfs_file_open+0x80/0x80
[ 51.517360][ T3639] ? read_lock_is_recursive+0x10/0x10
[ 51.522749][ T3639] ? rcu_read_lock_any_held+0xb1/0x130
[ 51.528210][ T3639] ? rcu_read_lock_bh_held+0xf0/0xf0
[ 51.533484][ T3639] ? vfs_fallocate+0x308/0x670
[ 51.538241][ T3639] vfs_fallocate+0x515/0x670
[ 51.542841][ T3639] __x64_sys_fallocate+0xb9/0x100
[ 51.547876][ T3639] do_syscall_64+0x3d/0xb0
[ 51.552279][ T3639] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 51.558166][ T3639] RIP: 0033:0x7f8a5ab3dab9
[ 51.562579][ T3639] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 51.582195][ T3639] RSP: 002b:00007ffcd127c488 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
[ 51.590601][ T3639] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f8a5ab3dab9
[ 51.598562][ T3639] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
[ 51.606533][ T3639] RBP: 00007ffcd127c4b0 R08: 0000000000000002 R09: 00007ffcd127c4c0
[ 51.614507][ T3639] R10: 0000000000280404 R11: 0000000000000246 R12: 0000000000000006
[ 51.622464][ T3639] R13: 00007ffcd127c4f0 R14: 00007ffcd127c4d0 R15: 0000000000000000
[ 51.630439][ T3639]
[ 51.633746][ T3639] ------------[ cut here ]------------
[ 51.639232][ T3639] kernel BUG at fs/btrfs/extent-io-tree.c:517!
[ 51.645435][ T3639] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[ 51.651497][ T3639] CPU: 0 PID: 3639 Comm: syz-executor114 Not tainted 6.1.0-rc7-syzkaller-00123-ga4412fdd49dc #0
[ 51.661888][ T3639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 51.671926][ T3639] RIP: 0010:clear_state_bit+0x325/0x330
[ 51.677460][ T3639] Code: 2f fe e9 9c fd ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c c7 fe ff ff 4c 89 ef e8 c5 06 2f fe e9 ba fe ff ff e8 cb ea da fd <0f> 0b 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 55 41
[ 51.697056][ T3639] RSP: 0018:ffffc90003bff5d0 EFLAGS: 00010293
[ 51.703125][ T3639] RAX: ffffffff83afad25 RBX: 00000000fffffff4 RCX: ffff888022f79d40
[ 51.711083][ T3639] RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000
[ 51.719035][ T3639] RBP: 0000000000000000 R08: ffffffff83afab52 R09: 00000000ffffffff
[ 51.726989][ T3639] R10: fffffbfff1a42e8f R11: 1ffffffff1a42e8e R12: ffff88806fc39c00
[ 51.734968][ T3639] R13: ffffc90003bff7d8 R14: 0000000000001000 R15: dffffc0000000000
[ 51.742927][ T3639] FS: 000055555682e300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
[ 51.751851][ T3639] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 51.758419][ T3639] CR2: 00007f8a5abb5140 CR3: 0000000073a71000 CR4: 00000000003506f0
[ 51.766375][ T3639] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 51.774332][ T3639] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 51.782285][ T3639] Call Trace:
[ 51.785553][ T3639]
[ 51.788476][ T3639] __clear_extent_bit+0x669/0xc60
[ 51.793487][ T3639] clear_record_extent_bits+0x4e/0x80
[ 51.798852][ T3639] __btrfs_qgroup_release_data+0x4b9/0x850
[ 51.804659][ T3639] ? btrfs_qgroup_free_data+0x40/0x40
[ 51.810020][ T3639] ? rcu_read_lock_sched_held+0x87/0x110
[ 51.815637][ T3639] __btrfs_prealloc_file_range+0x5b1/0x1470
[ 51.821518][ T3639] ? btrfs_prealloc_file_range+0x50/0x50
[ 51.827131][ T3639] ? btrfs_reserve_metadata_bytes+0x170/0x170
[ 51.833181][ T3639] ? wake_bit_function+0x240/0x240
[ 51.838277][ T3639] ? qgroup_reserve_data+0x1d7/0x6f0
[ 51.843547][ T3639] ? __bpf_trace_rcu_stall_warning+0x10/0x10
[ 51.849510][ T3639] btrfs_prealloc_file_range+0x3c/0x50
[ 51.854952][ T3639] btrfs_fallocate+0x1ba7/0x2020
[ 51.859876][ T3639] ? btrfs_file_open+0x80/0x80
[ 51.864621][ T3639] ? read_lock_is_recursive+0x10/0x10
[ 51.869974][ T3639] ? rcu_read_lock_any_held+0xb1/0x130
[ 51.875420][ T3639] ? rcu_read_lock_bh_held+0xf0/0xf0
[ 51.880710][ T3639] ? vfs_fallocate+0x308/0x670
[ 51.885456][ T3639] vfs_fallocate+0x515/0x670
[ 51.890035][ T3639] __x64_sys_fallocate+0xb9/0x100
[ 51.895056][ T3639] do_syscall_64+0x3d/0xb0
[ 51.899455][ T3639] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 51.905329][ T3639] RIP: 0033:0x7f8a5ab3dab9
[ 51.909725][ T3639] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 51.929311][ T3639] RSP: 002b:00007ffcd127c488 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
[ 51.937703][ T3639] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f8a5ab3dab9
[ 51.945661][ T3639] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
[ 51.953615][ T3639] RBP: 00007ffcd127c4b0 R08: 0000000000000002 R09: 00007ffcd127c4c0
[ 51.961666][ T3639] R10: 0000000000280404 R11: 0000000000000246 R12: 0000000000000006
[ 51.969626][ T3639] R13: 00007ffcd127c4f0 R14: 00007ffcd127c4d0 R15: 0000000000000000
[ 51.977583][ T3639]
[ 51.980581][ T3639] Modules linked in:
[ 51.984500][ T3639] ---[ end trace 0000000000000000 ]---
[ 51.989951][ T3639] RIP: 0010:clear_state_bit+0x325/0x330
[ 51.995525][ T3639] Code: 2f fe e9 9c fd ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c c7 fe ff ff 4c 89 ef e8 c5 06 2f fe e9 ba fe ff ff e8 cb ea da fd <0f> 0b 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 55 41
[ 52.016020][ T3639] RSP: 0018:ffffc90003bff5d0 EFLAGS: 00010293
[ 52.022072][ T3639] RAX: ffffffff83afad25 RBX: 00000000fffffff4 RCX: ffff888022f79d40
[ 52.030061][ T3639] RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000
[ 52.038056][ T3639] RBP: 0000000000000000 R08: ffffffff83afab52 R09: 00000000ffffffff
[ 52.046056][ T3639] R10: fffffbfff1a42e8f R11: 1ffffffff1a42e8e R12: ffff88806fc39c00
[ 52.054123][ T3639] R13: ffffc90003bff7d8 R14: 0000000000001000 R15: dffffc0000000000
[ 52.062169][ T3639] FS: 000055555682e300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
[ 52.071134][ T3639] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 52.077747][ T3639] CR2: 00007f8a5abb5140 CR3: 0000000073a71000 CR4: 00000000003506f0
[ 52.085748][ T3639] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 52.093713][ T3639] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 52.101705][ T3639] Kernel panic - not syncing: Fatal exception
[ 52.107919][ T3639] Kernel Offset: disabled
[ 52.112234][ T3639] Rebooting in 86400 seconds..