./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1508662819
<...>
Warning: Permanently added '10.128.0.223' (ED25519) to the list of known hosts.
execve("./syz-executor1508662819", ["./syz-executor1508662819"], 0x7ffe69f63970 /* 10 vars */) = 0
brk(NULL) = 0x555555f2e000
brk(0x555555f2ed00) = 0x555555f2ed00
arch_prctl(ARCH_SET_FS, 0x555555f2e380) = 0
set_tid_address(0x555555f2e650) = 5820
set_robust_list(0x555555f2e660, 24) = 0
rseq(0x555555f2eca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1508662819", 4096) = 28
getrandom("\xf2\xf0\xa0\xe0\x59\x91\x15\x3e", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555555f2ed00
brk(0x555555f4fd00) = 0x555555f4fd00
brk(0x555555f50000) = 0x555555f50000
mprotect(0x7f8496e1c000, 16384, PROT_READ) = 0
mmap(0x3ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3ffffffff000
mmap(0x400000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400000000000
mmap(0x400001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400001000000
mkdir("./syzkaller.7IBMpZ", 0700) = 0
chmod("./syzkaller.7IBMpZ", 0777) = 0
chdir("./syzkaller.7IBMpZ") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5821 attached
, child_tidptr=0x555555f2e650) = 5821
[pid 5821] set_robust_list(0x555555f2e660, 24) = 0
[pid 5821] chdir("./0") = 0
[pid 5821] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5821] setpgid(0, 0) = 0
[pid 5821] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5821] write(3, "1000", 4) = 4
[pid 5821] close(3) = 0
[pid 5821] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5821] write(1, "executing program\n", 18executing program
) = 18
[pid 5821] memfd_create("syzkaller", 0) = 3
[pid 5821] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f848e800000
[pid 5821] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144
[pid 5821] munmap(0x7f848e800000, 138412032) = 0
[pid 5821] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5821] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5821] close(3) = 0
[pid 5821] close(4) = 0
[pid 5821] mkdir("./file0", 0777) = 0
[ 61.750978][ T5821] loop0: detected capacity change from 0 to 512
[ 61.787225][ T5821] EXT4-fs (loop0): Cannot turn on journaled quota: type 0: error -13
[ 61.798054][ T5821] EXT4-fs error (device loop0): ext4_clear_blocks:876: inode #13: comm syz-executor150: attempt to clear invalid blocks 2 len 1
[ 61.812913][ T5821] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters
[ 61.828444][ T5821] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #13: comm syz-executor150: invalid indirect mapped block 1819239214 (level 0)
[pid 5821] mount("/dev/loop0", "./file0", "ext4", 0, "dax=never,dioread_nolock,barrier,delalloc,jqfmt=vfsv0,usrjquota=..,errors=continue") = 0
[pid 5821] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5821] chdir("./file0") = 0
[pid 5821] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[pid 5821] mount(NULL, "./file0", "proc", 0, NULL) = 0
[pid 5821] exit_group(0) = ?
[pid 5821] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5821, si_uid=0, si_status=0, si_utime=0, si_stime=8 /* 0.08 s */} ---
[ 61.844488][ T5821] EXT4-fs error (device loop0): ext4_free_branches:1023: inode #13: comm syz-executor150: invalid indirect mapped block 1819239214 (level 1)
[ 61.861317][ T5821] EXT4-fs (loop0): 1 truncate cleaned up
[ 61.867762][ T5821] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x555555f2f6f0 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs") = 0
umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
newfstatat(AT_FDCWD, "./0/file0", {st_mode=S_IFDIR|0755, st_size=1024, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EBUSY (Device or resource busy)
openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=1024, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x555555f37730 /* 7 entries */, 32768) = 208
umount2("./0/file0/lost+found", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/file0/lost+found", {st_mode=S_IFDIR|0700, st_size=11264, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/file0/lost+found", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/file0/lost+found", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 5
[ 62.058551][ T5820] EXT4-fs error (device loop0): htree_dirblock_to_tree:1112: inode #2: block 13: comm syz-executor150: bad entry in directory: rec_len % 4 != 0 - offset=108, inode=4294901777, rec_len=65535, size=1024 fake=0
newfstatat(5, "", {st_mode=S_IFDIR|0700, st_size=11264, ...}, AT_EMPTY_PATH) = 0
getdents64(5, 0x555555f3f770 /* 2 entries */, 32768) = 48
getdents64(5, 0x555555f3f770 /* 0 entries */, 32768) = 0
close(5) = 0
rmdir("./0/file0/lost+found") = 0
umount2("./0/file0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./0/file0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/file0/file0", {st_mode=S_IFDIR|0755, st_size=60, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/file0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/file0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 5
newfstatat(5, "", {st_mode=S_IFDIR|0755, st_size=60, ...}, AT_EMPTY_PATH) = 0
getdents64(5, 0x555555f3f770 /* 4 entries */, 32768) = 112
umount2("./0/file0/file0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/file0/file0/file0", {st_mode=S_IFREG|0755, st_size=1050, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/file0/file0/file0") = 0
[ 62.208756][ T5820] ------------[ cut here ]------------
[ 62.214595][ T5820] bad length passed for symlink [/tmp/syz-imagegen2884317625/] (got 39, expected 29)
[ 62.214724][ T5820] WARNING: CPU: 0 PID: 5820 at ./include/linux/fs.h:803 inode_set_cached_link+0xd0/0x110
[ 62.234134][ T5820] Modules linked in:
[ 62.238107][ T5820] CPU: 0 UID: 0 PID: 5820 Comm: syz-executor150 Not tainted 6.14.0-rc1-syzkaller-00187-g8f6629c004b1 #0
[ 62.249270][ T5820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 62.259411][ T5820] RIP: 0010:inode_set_cached_link+0xd0/0x110
[ 62.265471][ T5820] Code: 41 5f 5d c3 cc cc cc cc e8 ad ff 46 ff c6 05 9a ea 8b 0d 01 90 48 c7 c7 20 be 1d 8c 4c 89 f6 44 89 fa 89 e9 e8 71 aa 07 ff 90 <0f> 0b 90 90 e9 6a ff ff ff 89 f9 80 e1 07 80 c1 03 38 c1 7c a1 e8
[ 62.285173][ T5820] RSP: 0018:ffffc90003ee7698 EFLAGS: 00010246
[ 62.291260][ T5820] RAX: 7983de5048bc5400 RBX: ffff88807cb0c808 RCX: ffff888035fe9e00
[ 62.299307][ T5820] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 62.307335][ T5820] RBP: 000000000000001d R08: ffffffff81800b32 R09: 1ffff110170c519a
[ 62.315368][ T5820] R10: dffffc0000000000 R11: ffffed10170c519b R12: ffff88807cb0c808
[ 62.323358][ T5820] R13: dffffc0000000000 R14: ffff88807cb0c558 R15: 0000000000000027
[ 62.331400][ T5820] FS: 0000555555f2e380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
[ 62.340392][ T5820] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 62.347020][ T5820] CR2: 00007fff4d688e08 CR3: 000000007c310000 CR4: 00000000003526f0
[ 62.355029][ T5820] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 62.362989][ T5820] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 62.371031][ T5820] Call Trace:
[ 62.374369][ T5820] <TASK>
[ 62.377295][ T5820] ? __warn+0x165/0x4d0
[ 62.381459][ T5820] ? inode_set_cached_link+0xd0/0x110
[ 62.386886][ T5820] ? report_bug+0x2b3/0x500
[ 62.391418][ T5820] ? inode_set_cached_link+0xd0/0x110
[ 62.396841][ T5820] ? handle_bug+0x60/0x90
[ 62.401190][ T5820] ? exc_invalid_op+0x1a/0x50
[ 62.405957][ T5820] ? asm_exc_invalid_op+0x1a/0x20
[ 62.410997][ T5820] ? __warn_printk+0x292/0x360
[ 62.415806][ T5820] ? inode_set_cached_link+0xd0/0x110
[ 62.421191][ T5820] ? inode_set_cached_link+0xcf/0x110
[ 62.426617][ T5820] __ext4_iget+0x2ea4/0x3f30
[ 62.431219][ T5820] ? __pfx_lock_release+0x10/0x10
[ 62.436307][ T5820] ? __pfx___ext4_iget+0x10/0x10
[ 62.441254][ T5820] ? ext4_fname_free_filename+0x89/0xb0
[ 62.446862][ T5820] ? rcu_is_watching+0x15/0xb0
[ 62.451652][ T5820] ? ext4_fname_free_filename+0x89/0xb0
[ 62.457251][ T5820] ? kfree+0x4e/0x430
[ 62.461260][ T5820] ext4_lookup+0x3e3/0x750
[ 62.465743][ T5820] ? __pfx_ext4_lookup+0x10/0x10
[ 62.470696][ T5820] ? __init_waitqueue_head+0xae/0x150
[ 62.476154][ T5820] __lookup_slow+0x296/0x400
[ 62.480766][ T5820] ? __pfx___lookup_slow+0x10/0x10
[ 62.485991][ T5820] ? make_vfsuid+0x52/0xa0
[ 62.490515][ T5820] ? lookup_fast+0x17a/0x590
[ 62.495153][ T5820] lookup_slow+0x53/0x70
[ 62.499412][ T5820] walk_component+0x2e1/0x410
[ 62.504083][ T5820] path_lookupat+0x16f/0x450
[ 62.508729][ T5820] filename_lookup+0x2a3/0x670
[ 62.513512][ T5820] ? __virt_addr_valid+0x183/0x530
[ 62.518700][ T5820] ? __pfx_filename_lookup+0x10/0x10
[ 62.524030][ T5820] ? strncpy_from_user+0x146/0x270
[ 62.529240][ T5820] ? getname_flags+0x1e3/0x540
[ 62.534026][ T5820] user_path_at+0x3a/0x60
[ 62.538420][ T5820] __x64_sys_umount+0xf1/0x170
[ 62.543193][ T5820] ? __pfx___x64_sys_umount+0x10/0x10
[ 62.548613][ T5820] ? do_syscall_64+0x100/0x230
[ 62.553487][ T5820] do_syscall_64+0xf3/0x230
[ 62.558046][ T5820] ? clear_bhb_loop+0x35/0x90
[ 62.562743][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 62.568683][ T5820] RIP: 0033:0x7f8496da9487
[ 62.573120][ T5820] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 62.592817][ T5820] RSP: 002b:00007fff4d6873d8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 62.601318][ T5820] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8496da9487
[ 62.609330][ T5820] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff4d687490
[ 62.617344][ T5820] RBP: 00007fff4d687490 R08: 0000000000000000 R09: 0000000000000000
[ 62.625363][ T5820] R10: 00000000ffffffff R11: 0000000000000206 R12: 00007fff4d688580
[ 62.633344][ T5820] R13: 0000555555f3f740 R14: 0000000000000001 R15: 431bde82d7b634db
[ 62.641375][ T5820] </TASK>
[ 62.644467][ T5820] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 62.651762][ T5820] CPU: 0 UID: 0 PID: 5820 Comm: syz-executor150 Not tainted 6.14.0-rc1-syzkaller-00187-g8f6629c004b1 #0
[ 62.662868][ T5820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[ 62.672915][ T5820] Call Trace:
[ 62.676182][ T5820] <TASK>
[ 62.679101][ T5820] dump_stack_lvl+0x241/0x360
[ 62.683773][ T5820] ? __pfx_dump_stack_lvl+0x10/0x10
[ 62.688960][ T5820] ? __pfx__printk+0x10/0x10
[ 62.693543][ T5820] ? vscnprintf+0x5d/0x90
[ 62.697894][ T5820] panic+0x349/0x880
[ 62.701792][ T5820] ? __warn+0x174/0x4d0
[ 62.705956][ T5820] ? __pfx_panic+0x10/0x10
[ 62.710376][ T5820] __warn+0x344/0x4d0
[ 62.714347][ T5820] ? inode_set_cached_link+0xd0/0x110
[ 62.719731][ T5820] report_bug+0x2b3/0x500
[ 62.724073][ T5820] ? inode_set_cached_link+0xd0/0x110
[ 62.729451][ T5820] handle_bug+0x60/0x90
[ 62.733603][ T5820] exc_invalid_op+0x1a/0x50
[ 62.738110][ T5820] asm_exc_invalid_op+0x1a/0x20
[ 62.742950][ T5820] RIP: 0010:inode_set_cached_link+0xd0/0x110
[ 62.748919][ T5820] Code: 41 5f 5d c3 cc cc cc cc e8 ad ff 46 ff c6 05 9a ea 8b 0d 01 90 48 c7 c7 20 be 1d 8c 4c 89 f6 44 89 fa 89 e9 e8 71 aa 07 ff 90 <0f> 0b 90 90 e9 6a ff ff ff 89 f9 80 e1 07 80 c1 03 38 c1 7c a1 e8
[ 62.768523][ T5820] RSP: 0018:ffffc90003ee7698 EFLAGS: 00010246
[ 62.774591][ T5820] RAX: 7983de5048bc5400 RBX: ffff88807cb0c808 RCX: ffff888035fe9e00
[ 62.782559][ T5820] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 62.790521][ T5820] RBP: 000000000000001d R08: ffffffff81800b32 R09: 1ffff110170c519a
[ 62.798482][ T5820] R10: dffffc0000000000 R11: ffffed10170c519b R12: ffff88807cb0c808
[ 62.806444][ T5820] R13: dffffc0000000000 R14: ffff88807cb0c558 R15: 0000000000000027
[ 62.814416][ T5820] ? __warn_printk+0x292/0x360
[ 62.819192][ T5820] ? inode_set_cached_link+0xcf/0x110
[ 62.824563][ T5820] __ext4_iget+0x2ea4/0x3f30
[ 62.829150][ T5820] ? __pfx_lock_release+0x10/0x10
[ 62.834362][ T5820] ? __pfx___ext4_iget+0x10/0x10
[ 62.839299][ T5820] ? ext4_fname_free_filename+0x89/0xb0
[ 62.844840][ T5820] ? rcu_is_watching+0x15/0xb0
[ 62.849601][ T5820] ? ext4_fname_free_filename+0x89/0xb0
[ 62.855139][ T5820] ? kfree+0x4e/0x430
[ 62.859124][ T5820] ext4_lookup+0x3e3/0x750
[ 62.863535][ T5820] ? __pfx_ext4_lookup+0x10/0x10
[ 62.868477][ T5820] ? __init_waitqueue_head+0xae/0x150
[ 62.873849][ T5820] __lookup_slow+0x296/0x400
[ 62.878447][ T5820] ? __pfx___lookup_slow+0x10/0x10
[ 62.883563][ T5820] ? make_vfsuid+0x52/0xa0
[ 62.887983][ T5820] ? lookup_fast+0x17a/0x590
[ 62.892575][ T5820] lookup_slow+0x53/0x70
[ 62.896825][ T5820] walk_component+0x2e1/0x410
[ 62.901501][ T5820] path_lookupat+0x16f/0x450
[ 62.906092][ T5820] filename_lookup+0x2a3/0x670
[ 62.910854][ T5820] ? __virt_addr_valid+0x183/0x530
[ 62.915976][ T5820] ? __pfx_filename_lookup+0x10/0x10
[ 62.921274][ T5820] ? strncpy_from_user+0x146/0x270
[ 62.926394][ T5820] ? getname_flags+0x1e3/0x540
[ 62.931166][ T5820] user_path_at+0x3a/0x60
[ 62.935496][ T5820] __x64_sys_umount+0xf1/0x170
[ 62.940254][ T5820] ? __pfx___x64_sys_umount+0x10/0x10
[ 62.945629][ T5820] ? do_syscall_64+0x100/0x230
[ 62.950397][ T5820] do_syscall_64+0xf3/0x230
[ 62.954897][ T5820] ? clear_bhb_loop+0x35/0x90
[ 62.959578][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 62.965468][ T5820] RIP: 0033:0x7f8496da9487
[ 62.969882][ T5820] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8
[ 62.989484][ T5820] RSP: 002b:00007fff4d6873d8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 62.997895][ T5820] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8496da9487
[ 63.005866][ T5820] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff4d687490
[ 63.013838][ T5820] RBP: 00007fff4d687490 R08: 0000000000000000 R09: 0000000000000000
[ 63.021844][ T5820] R10: 00000000ffffffff R11: 0000000000000206 R12: 00007fff4d688580
[ 63.029810][ T5820] R13: 0000555555f3f740 R14: 0000000000000001 R15: 431bde82d7b634db
[ 63.037788][ T5820] </TASK>
[ 63.040939][ T5820] Kernel Offset: disabled
[ 63.045289][ T5820] Rebooting in 86400 seconds..