ci-upstream-linux-next-kasan-gce-root/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci-upstream-linux-next-kasan-gce-root/syz-executor3839676197 <...> Warning: Permanently added '10.128.0.203' (ED25519) to the list of known hosts. execve("ci-upstream-linux-next-kasan-gce-root/syz-executor3839676197", ["ci-upstream-linux-next-kasan-gce-root/syz-executor3839676197"], 0x7ffc923fed80 /* 10 vars */) = 0 brk(NULL) = 0x55556ee7d000 brk(0x55556ee7dd80) = 0x55556ee7dd80 arch_prctl(ARCH_SET_FS, 0x55556ee7d400) = 0 set_tid_address(0x55556ee7d6d0) = 5629 set_robust_list(0x55556ee7d6e0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci-upstream-linux-next-kasan-gce-root/syz-executor3839676197", 4096) = 66 getrandom("\xfb\x9b\xfb\x90\x89\x9f\x5c\x15", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55556ee7dd80 brk(0x55556ee9ed80) = 0x55556ee9ed80 brk(0x55556ee9f000) = 0x55556ee9f000 mprotect(0x7f86a05c1000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 getrandom("\x94\xa8\x1f\x20\x06\x0b\x0d\x89", 8, GRND_NONBLOCK) = 8 mkdir("./syzkaller.EDKWsy", 0700) = 0 chmod("./syzkaller.EDKWsy", 0777) = 0 chdir("./syzkaller.EDKWsy") = 0 unshare(CLONE_NEWPID) = 0 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLDci-upstream-linux-next-kasan-gce-root/strace-static-x86_64: Process 5630 attached , child_tidptr=0x55556ee7d6d0) = 5630 [pid 5629] rt_sigprocmask(SIG_SETMASK, [] [pid 5630] set_robust_list(0x55556ee7d6e0, 24) = 0 [pid 5629] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5630] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5630] getppid() = 0 [pid 5630] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5630] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5630] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5630] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5630] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5630] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5630] unshare(CLONE_NEWNS) = 0 [pid 5630] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5630] unshare(CLONE_NEWIPC) = 0 [pid 5630] unshare(CLONE_NEWCGROUP) = 0 [pid 5630] unshare(CLONE_NEWUTS) = 0 [pid 5630] unshare(CLONE_SYSVSEM) = 0 [pid 5630] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5630] write(3, "16777216", 8) = 8 [pid 5630] close(3) = 0 [pid 5630] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5630] write(3, "536870912", 9) = 9 [pid 5630] close(3) = 0 [pid 5630] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5630] write(3, "1024", 4) = 4 [pid 5630] close(3) = 0 [pid 5630] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5630] write(3, "8192", 4) = 4 [pid 5630] close(3) = 0 [pid 5630] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5630] write(3, "1024", 4) = 4 [pid 5630] close(3) = 0 [pid 5630] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5630] write(3, "1024", 4) = 4 [pid 5630] close(3) = 0 [pid 5630] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5630] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5630] close(3) = 0 [pid 5630] getpid() = 1 [pid 5630] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5630] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5635] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 5635] chdir("./0") = 0 [pid 5635] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5635] setpgid(0, 0) = 0 [pid 5635] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5635] write(3, "1000", 4) = 4 [pid 5635] close(3) = 0 [pid 5635] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5635] write(1, "executing program\n", 18) = 18 executing program [pid 5635] memfd_create("syzkaller", 0) = 3 [pid 5635] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f8698000000 [pid 5635] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 [pid 5635] munmap(0x7f8698000000, 138412032) = 0 [pid 5635] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 5635] ioctl(4, LOOP_SET_FD, 3) = 0 [pid 5635] close(3) = 0 [pid 5635] close(4) = 0 [pid 5635] mkdir("./file1", 0777) = 0 [pid 5635] mount("/dev/loop0", "./file1", "jfs", MS_NODEV|MS_POSIXACL|MS_STRICTATIME, "iocharset=koi8-u,nointegrity,iocharset=iso8859-14,errors=continue,discard,errors=remount-ro,integrit"...) = 0 [pid 5635] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3 [pid 5635] chdir("./file1") = 0 [pid 5635] openat(AT_FDCWD, "/dev/loop0", O_RDONLY) = 4 [pid 5635] ioctl(4, LOOP_CLR_FD) = 0 [pid 5635] close(4) = 0 [pid 5635] open(".", O_RDONLY|O_LARGEFILE) = 4 [ 96.367009][ T5635] loop0: detected capacity change from 0 to 32768 [pid 5635] getdents(4, 0x20000000be80 /* 5 entries */, 155) = 144 [pid 5635] mkdirat(AT_FDCWD, "./gadget", 0777) = 0 [pid 5635] mount(NULL, "./gadget", "gadgetfs", 0, NULL) = 0 [ 96.423997][ T5635] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3 [ 96.423997][ T5635] [ 96.425624][ T5635] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 4 [ 96.425624][ T5635] [pid 5635] close(3) = 0 [pid 5635] close(4) = 0 [pid 5635] close(5) = -1 EBADF (Bad file descriptor) [pid 5635] close(6) = -1 EBADF (Bad file descriptor) [pid 5635] close(7) = -1 EBADF (Bad file descriptor) [pid 5635] close(8) = -1 EBADF (Bad file descriptor) [pid 5635] close(9) = -1 EBADF (Bad file descriptor) [pid 5635] close(10) = -1 EBADF (Bad file descriptor) [pid 5635] close(11) = -1 EBADF (Bad file descriptor) [pid 5635] close(12) = -1 EBADF (Bad file descriptor) [pid 5635] close(13) = -1 EBADF (Bad file descriptor) [pid 5635] close(14) = -1 EBADF (Bad file descriptor) [pid 5635] close(15) = -1 EBADF (Bad file descriptor) [pid 5635] close(16) = -1 EBADF (Bad file descriptor) [pid 5635] close(17) = -1 EBADF (Bad file descriptor) [pid 5635] close(18) = -1 EBADF (Bad file descriptor) [pid 5635] close(19) = -1 EBADF (Bad file descriptor) [pid 5635] close(20) = -1 EBADF (Bad file descriptor) [pid 5635] close(21) = -1 EBADF (Bad file descriptor) [pid 5635] close(22) = -1 EBADF (Bad file descriptor) [pid 5635] close(23) = -1 EBADF (Bad file descriptor) [pid 5635] close(24) = -1 EBADF (Bad file descriptor) [pid 5635] close(25) = -1 EBADF (Bad file descriptor) [pid 5635] close(26) = -1 EBADF (Bad file descriptor) [pid 5635] close(27) = -1 EBADF (Bad file descriptor) [pid 5635] close(28) = -1 EBADF (Bad file descriptor) [pid 5635] close(29) = -1 EBADF (Bad file descriptor) [pid 5635] exit_group(0) = ? [pid 5635] +++ exited with 0 +++ [pid 5630] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=2, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=17 /* 0.17 s */} --- [pid 5630] restart_syscall(<... resuming interrupted rt_sigprocmask ...>) = 0 [pid 5630] umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5630] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5630] fstat(3, {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 [pid 5630] getdents64(3, 0x55556ee7e7b0 /* 4 entries */, 32768) = 112 [pid 5630] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) [pid 5630] newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0755, st_size=72, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5630] umount2("./0/file1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy) [pid 5630] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 5630] fstat(4, {st_mode=S_IFDIR|0755, st_size=72, ...}) = 0 [pid 5630] getdents64(4, 0x55556ee867f0 /* 6 entries */, 32768) = 168 [pid 5630] umount2("./0/file1/file.cold", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 ENOENT (No such file or directory) [pid 5630] newfstatat(AT_FDCWD, "./0/file1/file.cold", 0x7ffcb03fbe60, AT_SYMLINK_NOFOLLOW) = -1 ENOENT (No such file or directory) [pid 5630] exit_group(1) = ? [ 96.580664][ T5630] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 3 [ 96.580664][ T5630] [ 96.580704][ T5630] ERROR: (device loop0): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 5 [ 96.580704][ T5630] [ 96.632582][ T5630] Oops: general protection fault, probably for non-canonical address 0xdffffc018ef8da81: 0000 [#1] SMP KASAN PTI [ 96.644541][ T5630] KASAN: probably user-memory-access in range [0x0000000c77c6d408-0x0000000c77c6d40f] [ 96.654151][ T5630] CPU: 1 UID: 0 PID: 5630 Comm: syz-executor383 Not tainted syzkaller #0 PREEMPT(full) [ 96.663913][ T5630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 96.674025][ T5630] RIP: 0010:bpf_inode_storage_free+0x1f4/0x5c0 [ 96.680237][ T5630] Code: d2 c1 d2 ff c6 05 75 65 6d 0f 01 48 c7 c7 60 3f 17 8c be 53 03 00 00 48 c7 c2 a0 3f 17 8c e8 c3 21 ae ff 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 8d b0 45 00 4d 8b 36 e8 d5 24 f9 [ 96.699893][ T5630] RSP: 0018:ffffc90003a6f8f0 EFLAGS: 00010206 [ 96.705983][ T5630] RAX: 000000018ef8da81 RBX: ffff888075cd04c0 RCX: ffff888075cd0000 [ 96.714178][ T5630] RDX: 0000000000000000 RSI: ffffffff8c6e2360 RDI: ffffffff8c6e2320 [ 96.722194][ T5630] RBP: 0000000000000001 R08: ffffffff81f5d602 R09: 0000000000000000 [ 96.730182][ T5630] R10: dffffc0000000000 R11: fffffbfff1f42939 R12: dffffc0000000000 [ 96.738165][ T5630] R13: 1ffff1100eb9a098 R14: 0000000c77c6d408 R15: ffffffff81f5d602 [ 96.746163][ T5630] FS: 0000000000000000(0000) GS:ffff888123bad000(0000) knlGS:0000000000000000 [ 96.755105][ T5630] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 96.761701][ T5630] CR2: 00007f86a058ebbc CR3: 000000000fb48000 CR4: 00000000003526f0 [ 96.769681][ T5630] Call Trace: [ 96.772972][ T5630] [ 96.775904][ T5630] security_inode_free+0xdc/0x180 [ 96.780936][ T5630] __destroy_inode+0x2a1/0x630 [ 96.785705][ T5630] evict+0x8d4/0xb50 [ 96.789614][ T5630] ? __pfx_evict+0x10/0x10 [ 96.794070][ T5630] ? do_raw_spin_unlock+0xf5/0x200 [ 96.799186][ T5630] evict_inodes+0x844/0x8c0 [ 96.803696][ T5630] ? __pfx_cgroup_writeback_umount+0x10/0x10 [ 96.809700][ T5630] ? __pfx_evict_inodes+0x10/0x10 [ 96.814726][ T5630] ? jfs_sync_fs+0x87/0xa0 [ 96.819317][ T5630] ? sync_filesystem+0x1f9/0x240 [ 96.824791][ T5630] generic_shutdown_super+0xaa/0x2d0 [ 96.830291][ T5630] kill_block_super+0x44/0xa0 [ 96.834980][ T5630] deactivate_locked_super+0xbe/0x110 [ 96.840395][ T5630] cleanup_mnt+0x204/0x2a0 [ 96.844926][ T5630] task_work_run+0x1d9/0x260 [ 96.849622][ T5630] ? __pfx_task_work_run+0x10/0x10 [ 96.854944][ T5630] ? do_exit+0x700/0x2380 [ 96.860326][ T5630] ? kmem_cache_free+0x182/0x650 [ 96.866148][ T5630] ? put_net+0x16a/0x260 [ 96.870436][ T5630] do_exit+0x705/0x2380 [ 96.874616][ T5630] ? __pfx_do_exit+0x10/0x10 [ 96.879279][ T5630] ? do_raw_spin_lock+0x12b/0x2f0 [ 96.884450][ T5630] ? _raw_spin_unlock_irq+0x23/0x50 [ 96.889670][ T5630] do_group_exit+0x22d/0x2f0 [ 96.894315][ T5630] __x64_sys_exit_group+0x3f/0x40 [ 96.900066][ T5630] x64_sys_call+0x18c6/0x18d0 [ 96.904865][ T5630] do_syscall_64+0x166/0x520 [ 96.909539][ T5630] ? trace_irq_disable+0x3b/0x140 [ 96.914770][ T5630] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.921127][ T5630] ? clear_bhb_loop+0x70/0xc0 [ 96.926014][ T5630] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.931926][ T5630] RIP: 0033:0x7f86a052dac5 [ 96.936361][ T5630] Code: Unable to access opcode bytes at 0x7f86a052da9b. [ 96.943390][ T5630] RSP: 002b:00007ffcb03fbdc8 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 96.951834][ T5630] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f86a052dac5 [ 96.959808][ T5630] RDX: 00000000000000e7 RSI: ffffffffffffffd8 RDI: 0000000000000001 [ 96.967781][ T5630] RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000ffffffff [ 96.977053][ T5630] R10: 0000000000000100 R11: 0000000000000206 R12: 0000000000000001 [ 96.985039][ T5630] R13: 00007f86a05c6110 R14: 00007f86a05c86a8 R15: 00007f86a05c86c0 [ 96.993044][ T5630] [ 96.996102][ T5630] Modules linked in: [ 97.000255][ T5630] ---[ end trace 0000000000000000 ]--- [ 97.005858][ T5630] RIP: 0010:bpf_inode_storage_free+0x1f4/0x5c0 [ 97.005892][ T5630] Code: d2 c1 d2 ff c6 05 75 65 6d 0f 01 48 c7 c7 60 3f 17 8c be 53 03 00 00 48 c7 c2 a0 3f 17 8c e8 c3 21 ae ff 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 8d b0 45 00 4d 8b 36 e8 d5 24 f9 [ 97.005911][ T5630] RSP: 0018:ffffc90003a6f8f0 EFLAGS: 00010206 [ 97.005933][ T5630] RAX: 000000018ef8da81 RBX: ffff888075cd04c0 RCX: ffff888075cd0000 [ 97.005949][ T5630] RDX: 0000000000000000 RSI: ffffffff8c6e2360 RDI: ffffffff8c6e2320 [ 97.005967][ T5630] RBP: 0000000000000001 R08: ffffffff81f5d602 R09: 0000000000000000 [ 97.005981][ T5630] R10: dffffc0000000000 R11: fffffbfff1f42939 R12: dffffc0000000000 [ 97.005996][ T5630] R13: 1ffff1100eb9a098 R14: 0000000c77c6d408 R15: ffffffff81f5d602 [ 97.006013][ T5630] FS: 0000000000000000(0000) GS:ffff888123bad000(0000) knlGS:0000000000000000 [ 97.006031][ T5630] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.006045][ T5630] CR2: 00007f86a058ebbc CR3: 000000000fb48000 CR4: 00000000003526f0 [ 97.006067][ T5630] Kernel panic - not syncing: Fatal exception [ 97.108724][ T5630] Kernel Offset: disabled [ 97.113081][ T5630] Rebooting in 86400 seconds..